Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 00db063b authored by Geert Uytterhoeven's avatar Geert Uytterhoeven Committed by Todd Kjos
Browse files

FROMLIST: ARM: amba: Don't read past the end of sysfs "driver_override" buffer 



When printing the driver_override parameter when it is 4095 and 4094
bytes long, the printing code would access invalid memory because we
need count + 1 bytes for printing.

Cfr. commits 4efe874a ("PCI: Don't read past the end of sysfs
"driver_override" buffer") and bf563b01c2895a4b ("driver core: platform:
Don't read past the end of "driver_override" buffer").

Fixes: 3cf38571 ("ARM: 8256/1: driver coamba: add device binding path 'driver_override'")
Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
(cherry picked from: https://patchwork.kernel.org/patch/10175611/

)
Signed-off-by: default avatarTodd Kjos <tkjos@google.com>

Change-Id: I7a9fffc8e3cc775fcf693edae7b42d57c0a375c5
parent d3a2afb9

drivers/amba/bus.c

+2 −1
Original line number Diff line number Diff line
@@ -83,7 +83,8 @@ static ssize_t driver_override_store(struct device *_dev, 
	struct amba_device *dev = to_amba_device(_dev);

	char *driver_override, *old = dev->driver_override, *cp;



	if (count > PATH_MAX)

	/* We need to keep extra room for a newline */

	if (count >= (PAGE_SIZE - 1))

		return -EINVAL;



	driver_override = kstrndup(buf, count, GFP_KERNEL);