samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

asoc: codecs: Fix out of bounds access in register show functions

Browse Source 
In register show functions, when snprintf returns a negative value
out of bounds access occurs while copying the data to user.
Add return value check on snprintf before copy_to_user
to fix this.

Change-Id: I1eb793721c653bf6d1fbd10f4cea3436ffe6f519
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
This commit is contained in:
Aditya Bavanari
2019-06-21 15:56:39 +05:30
parent 45d02bcf0b
commit 8aacfcf7ab
3 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
asoc/codecs/wcd9xxx-core.c
View File

@@ -709,6 +709,11 @@ static ssize_t wcd9xxx_slimslave_reg_show(char __user *ubuf, size_t count,
reg_val = wcd9xxx_interface_reg_read(debugCodec, i); reg_val = wcd9xxx_interface_reg_read(debugCodec, i);
len = snprintf(tmp_buf, sizeof(tmp_buf), len = snprintf(tmp_buf, sizeof(tmp_buf),
"0x%.3x: 0x%.2x\n", i, reg_val); "0x%.3x: 0x%.2x\n", i, reg_val);
if (len < 0) {
pr_err("%s: fail to fill the buffer\n", __func__);
total = -EFAULT;
goto copy_err;
}
if ((total + len) >= count - 1) if ((total + len) >= count - 1)
break; break;

8
asoc/codecs/wsa881x.c
View File

@@ -105,7 +105,7 @@ struct wsa881x_priv {
#define SWR_SLV_MAX_REG_ADDR 0x390 #define SWR_SLV_MAX_REG_ADDR 0x390
#define SWR_SLV_START_REG_ADDR 0x40 #define SWR_SLV_START_REG_ADDR 0x40
#define SWR_SLV_MAX_BUF_LEN 20 #define SWR_SLV_MAX_BUF_LEN 25
#define BYTES_PER_LINE 12 #define BYTES_PER_LINE 12
#define SWR_SLV_RD_BUF_LEN 8 #define SWR_SLV_RD_BUF_LEN 8
#define SWR_SLV_WR_BUF_LEN 32 #define SWR_SLV_WR_BUF_LEN 32
@@ -393,6 +393,12 @@ static ssize_t wsa881x_swrslave_reg_show(char __user *ubuf, size_t count,
i, &reg_val, 1); i, &reg_val, 1);
len = snprintf(tmp_buf, 25, "0x%.3x: 0x%.2x\n", i, len = snprintf(tmp_buf, 25, "0x%.3x: 0x%.2x\n", i,
(reg_val & 0xFF)); (reg_val & 0xFF));
if (len < 0) {
pr_err("%s: fail to fill the buffer\n", __func__);
total = -EFAULT;
goto copy_err;
}
if ((total + len) >= count - 1) if ((total + len) >= count - 1)
break; break;
if (copy_to_user((ubuf + total), tmp_buf, len)) { if (copy_to_user((ubuf + total), tmp_buf, len)) {

6
soc/swr-wcd-ctrl.c
View File

@@ -265,6 +265,12 @@ static ssize_t swrm_reg_show(char __user *ubuf, size_t count,
i <= SWR_MSTR_MAX_REG_ADDR; i += 4) { i <= SWR_MSTR_MAX_REG_ADDR; i += 4) {
reg_val = dbgswrm->read(dbgswrm->handle, i); reg_val = dbgswrm->read(dbgswrm->handle, i);
len = snprintf(tmp_buf, 25, "0x%.3x: 0x%.2x\n", i, reg_val); len = snprintf(tmp_buf, 25, "0x%.3x: 0x%.2x\n", i, reg_val);
if (len < 0) {
pr_err("%s: fail to fill the buffer\n", __func__);
total = -EFAULT;
goto copy_err;
}
if ((total + len) >= count - 1) if ((total + len) >= count - 1)
break; break;
if (copy_to_user((ubuf + total), tmp_buf, len)) { if (copy_to_user((ubuf + total), tmp_buf, len)) {