lkml.org 
[lkml]   [2022]   [Aug]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.19 0813/1157] eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 71d46f1ff2212ced4852c7e77c5176382a1bdcec ]

    The simple_write_to_buffer() function will return positive/success if it
    is able to write a single byte anywhere within the buffer. However that
    potentially leaves a lot of the buffer uninitialized.

    In this code it's better to return 0 if the offset is non-zero. This
    code is not written to support partial writes. And then return -EFAULT
    if the buffer is not completely initialized.

    Fixes: cfad6425382e ("eeprom: Add IDT 89HPESx EEPROM/CSR driver")
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Link: https://lore.kernel.org/r/Ysg1Pu/nzSMe3r1q@kili
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/misc/eeprom/idt_89hpesx.c | 8 ++++++--
    1 file changed, 6 insertions(+), 2 deletions(-)

    diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c
    index b0cff4b152da..7f430742ce2b 100644
    --- a/drivers/misc/eeprom/idt_89hpesx.c
    +++ b/drivers/misc/eeprom/idt_89hpesx.c
    @@ -909,14 +909,18 @@ static ssize_t idt_dbgfs_csr_write(struct file *filep, const char __user *ubuf,
    u32 csraddr, csrval;
    char *buf;

    + if (*offp)
    + return 0;
    +
    /* Copy data from User-space */
    buf = kmalloc(count + 1, GFP_KERNEL);
    if (!buf)
    return -ENOMEM;

    - ret = simple_write_to_buffer(buf, count, offp, ubuf, count);
    - if (ret < 0)
    + if (copy_from_user(buf, ubuf, count)) {
    + ret = -EFAULT;
    goto free_buf;
    + }
    buf[count] = 0;

    /* Find position of colon in the buffer */
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-16 06:43    [W:4.095 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site