lkml.org 
[lkml]   [2022]   [Jul]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write()
The simple_write_to_buffer() here is used to copy a string from the
user. However the function call will succeed if it manages to read
just one byte anywhere within the buffer while we need the whole string
to be initialized to avoid using uninitialized data.

Fixes: cfad6425382e ("eeprom: Add IDT 89HPESx EEPROM/CSR driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/misc/eeprom/idt_89hpesx.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c
index b0cff4b152da..30e146b32205 100644
--- a/drivers/misc/eeprom/idt_89hpesx.c
+++ b/drivers/misc/eeprom/idt_89hpesx.c
@@ -909,15 +909,13 @@ static ssize_t idt_dbgfs_csr_write(struct file *filep, const char __user *ubuf,
u32 csraddr, csrval;
char *buf;

- /* Copy data from User-space */
- buf = kmalloc(count + 1, GFP_KERNEL);
- if (!buf)
- return -ENOMEM;
+ if (*offp != 0)
+ return -EINVAL;

- ret = simple_write_to_buffer(buf, count, offp, ubuf, count);
- if (ret < 0)
- goto free_buf;
- buf[count] = 0;
+ /* Copy data from User-space */
+ buf = strndup_user(ubuf, count + 1);
+ if (IS_ERR(buf))
+ return PTR_ERR(buf);

/* Find position of colon in the buffer */
colon_ch = strnchr(buf, count, ':');
--
2.35.1
\
 
 \ /
  Last update: 2022-07-06 09:00    [W:0.207 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site