Skip to contentSkip to conversation

platform/chrome: fix memory corruption in ioctl

PATCH Applied Dan Carpenter 3 participants 4 messages Aug 19, 2022 – Aug 24, 2022

Subsystems (3)
Kernel janitors ChromeOS EC subdrivers Chrome hardware platform support
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 platform/chrome: fix memory corruption in ioctl

If "s_mem.bytes" is larger than the buffer size it leads to memory corruption.

Fixes eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/platform/chrome/cros_ec_chardev.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/platform/chrome/cros_ec_chardev.c +3 -0
index fd33de546aee..2442dce4e208 100644
@@ -327,6 +327,9 @@ static long cros_ec_chardev_ioctl_readmem(struct cros_ec_dev *ec,
 	if (copy_from_user(&s_mem, arg, sizeof(s_mem)))
 		return -EFAULT;
 
+	if (s_mem.bytes > sizeof(s_mem.buffer))
+		return -EINVAL;
+
 	num = ec_dev->cmd_readmem(ec_dev, s_mem.offset, s_mem.bytes,
 				  s_mem.buffer);
 	if (num <= 0)
Signature · 1 line
2.35.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 6 lines · Dan Carpenter

If "s_mem.bytes" is larger than the buffer size it leads to memory corruption.

Fixes eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC")
Signed-off-by Dan Carpenter <[email protected]>
Reviewed-by Guenter Roeck <[email protected]>
Quoted 21 lines
---
 drivers/platform/chrome/cros_ec_chardev.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/platform/chrome/cros_ec_chardev.c +3 -1
index fd33de546aee..2442dce4e208 100644
@@ -327,6 +327,9 @@ static long cros_ec_chardev_ioctl_readmem(struct cros_ec_dev *ec,
        if (copy_from_user(&s_mem, arg, sizeof(s_mem)))
                return -EFAULT;
 
+       if (s_mem.bytes > sizeof(s_mem.buffer))
+               return -EINVAL;
+
        num = ec_dev->cmd_readmem(ec_dev, s_mem.offset, s_mem.bytes,
                                  s_mem.buffer);
        if (num <= 0)
--

2.35.1

CI Applied
#2 lore raw
In reply to Dan Carpenter
This patch was applied to chrome-platform/linux.git (for-kernelci) by Tzung-Bi Shih <[email protected]>:

Hello:

This patch was applied to chrome-platform/linux.git (for-kernelci) by Tzung-Bi Shih <[email protected]>:

Quoted 8 lines · On Fri, 19 Aug 2022 08:20:36 +0300 you wrote:

If "s_mem.bytes" is larger than the buffer size it leads to memory corruption.

Fixes eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/platform/chrome/cros_ec_chardev.c | 3 +++
 1 file changed, 3 insertions(+)

Here is the summary with links:
- platform/chrome: fix memory corruption in ioctl

    https://git.kernel.org/chrome-platform/c/8a07b45fd3c2

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
CI Applied
#3 lore raw
In reply to Dan Carpenter
This patch was applied to chrome-platform/linux.git (for-next) by Tzung-Bi Shih <[email protected]>:

Hello:

This patch was applied to chrome-platform/linux.git (for-next) by Tzung-Bi Shih <[email protected]>:

Quoted 8 lines · On Fri, 19 Aug 2022 08:20:36 +0300 you wrote:

If "s_mem.bytes" is larger than the buffer size it leads to memory corruption.

Fixes eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/platform/chrome/cros_ec_chardev.c | 3 +++
 1 file changed, 3 insertions(+)

Here is the summary with links:
- platform/chrome: fix memory corruption in ioctl

    https://git.kernel.org/chrome-platform/c/8a07b45fd3c2

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html