samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

soc: Fix out of bounds access in register show function

Browse Source 
In register show function, when snprintf returns a negative value
out of bounds access occurs while copying the data to user.
Add return value check on snprintf before copy_to_user
to fix this.

Change-Id: I96bfa64b1603c966852c1d4d4a12651664f17aed
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
This commit is contained in:
Aditya Bavanari
2019-08-27 22:18:41 +05:30
parent 47673f2f83
commit 9f599b4a78
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
soc/swr-mstr-ctrl.c
View File

@@ -144,6 +144,11 @@ static ssize_t swrm_reg_show(char __user *ubuf, size_t count,
i <= SWR_MSTR_MAX_REG_ADDR; i += 4) {
reg_val = dbgswrm->read(dbgswrm->handle, i);
len = snprintf(tmp_buf, 25, "0x%.3x: 0x%.2x\n", i, reg_val);
if (len < 0) {
pr_err("%s: fail to fill the buffer\n", __func__);
total = -EFAULT;
goto copy_err;
}
if ((total + len) >= count - 1)
break;
if (copy_to_user((ubuf + total), tmp_buf, len)) {