Messages in this thread Patch in this message | | | From | Rui Miguel Silva <> | Subject | Re: [PATCH] staging: greybus: power_supply: fix prop-descriptor request size | Date | Thu, 04 Apr 2019 08:06:53 +0100 |
| |
Hi Johan, Thanks for the patch.
On Thu 04 Apr 2019 at 07:53, Johan Hovold wrote: > Since moving the message buffers off the stack, the dynamically > allocated get-prop-descriptor request buffer is incorrectly > sized due to > using the pointer rather than request-struct size when creating > the > operation. > > Fortunately, the pointer size is always larger than this > one-byte > request, but this could still cause trouble on the remote end > due to the > unexpected message size. > > Fixes: 9d15134d067e ("greybus: power_supply: rework get > descriptors") > Cc: stable <stable@vger.kernel.org> # 4.9 > Cc: Rui Miguel Silva <rui.silva@linaro.org> > Signed-off-by: Johan Hovold <johan@kernel.org>
Nice catch. LGTM.
Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com>
--- Cheers, Rui
> --- > drivers/staging/greybus/power_supply.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/greybus/power_supply.c > b/drivers/staging/greybus/power_supply.c > index 0529e5628c24..ae5c0285a942 100644 > --- a/drivers/staging/greybus/power_supply.c > +++ b/drivers/staging/greybus/power_supply.c > @@ -520,7 +520,7 @@ static int > gb_power_supply_prop_descriptors_get(struct gb_power_supply > *gbpsy) > > op = gb_operation_create(connection, > GB_POWER_SUPPLY_TYPE_GET_PROP_DESCRIPTORS, > - sizeof(req), sizeof(*resp) + > props_count * > + sizeof(*req), sizeof(*resp) + > props_count * > sizeof(struct > gb_power_supply_props_desc), > GFP_KERNEL); > if (!op)
| |