lkml.org 
[lkml]   [2022]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 535/779] platform/olpc: Fix uninitialized data in debugfs write
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 40ec787e1adf302c11668d4cc69838f4d584187d ]

    The call to:

    size = simple_write_to_buffer(cmdbuf, sizeof(cmdbuf), ppos, buf, size);

    will succeed if at least one byte is written to the "cmdbuf" buffer.
    The "*ppos" value controls which byte is written. Another problem is
    that this code does not check for errors so it's possible for the entire
    buffer to be uninitialized.

    Inintialize the struct to zero to prevent reading uninitialized stack
    data.

    Debugfs is normally only writable by root so the impact of this bug is
    very minimal.

    Fixes: 6cca83d498bd ("Platform: OLPC: move debugfs support from x86 EC driver")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Link: https://lore.kernel.org/r/YthIKn+TfZSZMEcM@kili
    Reviewed-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/platform/olpc/olpc-ec.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
    index 4ff5c3a12991..921520475ff6 100644
    --- a/drivers/platform/olpc/olpc-ec.c
    +++ b/drivers/platform/olpc/olpc-ec.c
    @@ -264,7 +264,7 @@ static ssize_t ec_dbgfs_cmd_write(struct file *file, const char __user *buf,
    int i, m;
    unsigned char ec_cmd[EC_MAX_CMD_ARGS];
    unsigned int ec_cmd_int[EC_MAX_CMD_ARGS];
    - char cmdbuf[64];
    + char cmdbuf[64] = "";
    int ec_cmd_bytes;

    mutex_lock(&ec_dbgfs_lock);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-15 21:29    [W:4.022 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site