| Message ID | 20250509150459.115489-1-markus.burri@mt.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v1] gpio: fix potential out-of-bound write | expand |
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> On Fri, 09 May 2025 17:04:59 +0200, Markus Burri wrote: > Check that the input size does not exceed the buffer size. > If a caller write more characters, count is truncated to the max available > space in "simple_write_to_buffer". > Write a zero termination afterwards. > > I tweaked the subject line: should have been: "gpio: virtuser: ...". Also: you sent it as v1 but it was in fact v2, please keep the series numbering even when splitting patches out of a bigger one. [1/1] gpio: fix potential out-of-bound write https://git.kernel.org/brgl/linux/c/7118be7c6072f40391923543fdd1563b8d56377c Best regards,
diff --git a/drivers/gpio/gpio-virtuser.c b/drivers/gpio/gpio-virtuser.c index 13407fd4f0eb..eab6726953b4 100644 --- a/drivers/gpio/gpio-virtuser.c +++ b/drivers/gpio/gpio-virtuser.c @@ -401,10 +401,15 @@ static ssize_t gpio_virtuser_direction_do_write(struct file *file, char buf[32], *trimmed; int ret, dir, val = 0; - ret = simple_write_to_buffer(buf, sizeof(buf), ppos, user_buf, count); + if (count >= sizeof(buf)) + return -EINVAL; + + ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count); if (ret < 0) return ret; + buf[ret] = '\0'; + trimmed = strim(buf); if (strcmp(trimmed, "input") == 0) { @@ -623,12 +628,15 @@ static ssize_t gpio_virtuser_consumer_write(struct file *file, char buf[GPIO_VIRTUSER_NAME_BUF_LEN + 2]; int ret; + if (count >= sizeof(buf)) + return -EINVAL; + ret = simple_write_to_buffer(buf, GPIO_VIRTUSER_NAME_BUF_LEN, ppos, user_buf, count); if (ret < 0) return ret; - buf[strlen(buf) - 1] = '\0'; + buf[ret] = '\0'; ret = gpiod_set_consumer_name(data->ad.desc, buf); if (ret)
Check that the input size does not exceed the buffer size. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". Write a zero termination afterwards. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202505091754.285hHbr2-lkp@intel.com/ Signed-off-by: Markus Burri <markus.burri@mt.com> --- drivers/gpio/gpio-virtuser.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) base-commit: 92a09c47464d040866cf2b4cd052bc60555185fb