From patchwork Thu Aug 24 01:04:04 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bjorn Andersson X-Patchwork-Id: 110864 Delivered-To: patch@linaro.org Received: by 10.140.95.78 with SMTP id h72csp4924013qge; Wed, 23 Aug 2017 18:04:12 -0700 (PDT) X-Received: by 10.98.27.22 with SMTP id b22mr4220033pfb.280.1503536652035; Wed, 23 Aug 2017 18:04:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1503536652; cv=none; d=google.com; s=arc-20160816; b=Muc3Nxz4gURvrEO4B/j/lRV91uefeA4OFxHpYKsF6lk5Z20przO3Wc8WQji9p8WnKz 5044lU5BE9p4MaVZcRNj+SSyZycdPtcy+pValMUEM9C9IvBPUyLnJq5fn6uD1RDT+V3y MESmOzip1a+aIZufMj+yZQJv76vqrXlTxFsvj6jPnkdR4XKgDmoFMOYzFJ0FpS5/S6Sx j76vCwV996hSEvDg9CFUyKpwqCAv7N/TWY2bNsMmXpAArYA6qZGJeTEsSTafiH09OYDD mj1WQiwVRpboDJPErJvTItJ5jkys3LLq99elRu89fPQOoeIr6vNcKvumQfqUGexhdXu+ dj4g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :dkim-signature:arc-authentication-results; bh=LZKrRJk/SwkonlKwqMoPS5651GGjbj25ScpCTtLAlmA=; b=Y8a+z4YF+miX7E5dAp11r30jgwWAy+sKsr+w9yJqzLTvWI4MSgTb2J1EEcQYgHjXlP AT/QN+YwDPi3CAcOI2JUNdB5Dz9rwvECd5I3yGyqRIBLzijbTZkkAu+CdltonSZfqQTx 5NfQFcFJcxi1NMuSA7zRoqMkPAwKdkASzIiiTD2aJNtXw2YXxrw8GLBbVmSXc5SiXGTy st8JLqwwEZYi8J8OYd8szmUyXfn5B9JERyh3k6+BY+yksV5nH8jpQwYjBosPDh1BaAiG MYkT9zCmStuWmoUte20IXViDmAPbcZ8f42a+QGpH9Gt8ROiPhzPaqnyzl/sjjVtSZY3R 21Ug== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=WRJc/WEy; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d6si1852096pfa.96.2017.08.23.18.04.11; Wed, 23 Aug 2017 18:04:12 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=WRJc/WEy; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751214AbdHXBEK (ORCPT + 26 others); Wed, 23 Aug 2017 21:04:10 -0400 Received: from mail-pg0-f42.google.com ([74.125.83.42]:37960 "EHLO mail-pg0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751005AbdHXBEI (ORCPT ); Wed, 23 Aug 2017 21:04:08 -0400 Received: by mail-pg0-f42.google.com with SMTP id m133so7962764pga.5 for ; Wed, 23 Aug 2017 18:04:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=LZKrRJk/SwkonlKwqMoPS5651GGjbj25ScpCTtLAlmA=; b=WRJc/WEy4pm1eM3lJ3/eETN3+XFPN1uZ2xp524rTIxcW6V0e68+D+XrsqQ8rwDolvx fBUR87TNFD5IZpnAoIouWPK8qL8V2YLlopRII9bjrepPchU5NFbDurI41DEOOlPj3raE vFVC5GRqzjbbv/JWq/NhEF4IpS8ovM+7/MGk0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=LZKrRJk/SwkonlKwqMoPS5651GGjbj25ScpCTtLAlmA=; b=js+6mF13MbKRNpd6cZeyUt9TPJ4ahmPLGlZU2h14++e9KGSjqQ9aieQySROKX60qOk bI5gII+NsUqWS4YcHdyF5P7qRCntXtVQhys5tlpci5y5nUpqEvr/Y+12lkW44VkMY/Cy YthEZn7yNSheYiGILHfeA4Xebd6dIFnH5NDkc3XLpN0uqx2xuTTKT+Kpp72s/jjHiAgV 9GKkbDApWBT0fmIcQV8SW5j+u/ZHj8XYXSdJizUXm7cFuMX3Eq+sBqmvv1m4BORGjr3J a5kFAc+YkulqdqRLPL0j/0BdUt6c6cbTJ/1lD2/LDhdFZA0erWE+ggI2akAuj9jZwTev I/gQ== X-Gm-Message-State: AHYfb5h5V6WSoy2fdr2s4cl/0pdP7E6l3Ik/tO8L3defUFJiTJTn4tvx umFAqJa72bmkObQd X-Received: by 10.99.168.2 with SMTP id o2mr2862950pgf.207.1503536647417; Wed, 23 Aug 2017 18:04:07 -0700 (PDT) Received: from localhost.localdomain (ip68-111-217-79.sd.sd.cox.net. [68.111.217.79]) by smtp.gmail.com with ESMTPSA id b29sm5527032pfh.22.2017.08.23.18.04.06 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 23 Aug 2017 18:04:06 -0700 (PDT) From: Bjorn Andersson To: Rob Herring , Frank Rowand Cc: devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Rob Herring Subject: [PATCH] of/device: Prevent buffer overflow in of_device_modalias() Date: Wed, 23 Aug 2017 18:04:04 -0700 Message-Id: <20170824010404.9145-1-bjorn.andersson@linaro.org> X-Mailer: git-send-email 2.12.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org As of_device_get_modalias() returns the number of bytes that would have been written to the target string, regardless of how much did fit in the buffer, it's possible that the returned index points beyond the buffer passed to of_device_modalias() - causing memory beyond the buffer to be null terminated. Fixes: 0634c2958927 ("of: Add function for generating a DT modalias with a newline") Cc: Rob Herring Cc: stable@vger.kernel.org Signed-off-by: Bjorn Andersson --- drivers/of/device.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.12.0 diff --git a/drivers/of/device.c b/drivers/of/device.c index 7cff599a9c6a..b58ca92934cb 100644 --- a/drivers/of/device.c +++ b/drivers/of/device.c @@ -262,6 +262,8 @@ ssize_t of_device_modalias(struct device *dev, char *str, ssize_t len) ssize_t sl = of_device_get_modalias(dev, str, len - 2); if (sl < 0) return sl; + if (sl > len - 2) + return -ENOMEM; str[sl++] = '\n'; str[sl] = 0;