Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 28eb3950 authored by Liron Daniel's avatar Liron Daniel
Browse files

soc: spcom: Pass channel name as formatted string to device_create 



Pass channel name as formmated string to device_create call in
spcom_create_channel_chardevto prevent memory access issues when
using formatted string as channel name.

Change-Id: I549087a49e97f0b1a66ea5816eabfe80a6f7f1f7
Signed-off-by: default avatarLiron Daniel <lirond@codeaurora.org>
Signed-off-by: default avatarLiron Daniel <quic_lirond@quicinc.com>
parent 12bfefbc

drivers/soc/qcom/spcom.c

+12 −7
Original line number Diff line number Diff line
@@ -1536,7 +1536,6 @@ static int spcom_handle_create_channel_command(void *cmd_buf, int cmd_size) 
	int ret = 0;

	struct spcom_user_create_channel_command *cmd = cmd_buf;

	const char *ch_name;

	const size_t maxlen = sizeof(cmd->ch_name);



	if (cmd_size != sizeof(*cmd)) {

		pr_err("cmd_size [%d] , expected [%d].\n",
@@ -1545,11 +1544,6 @@ static int spcom_handle_create_channel_command(void *cmd_buf, int cmd_size) 
	}



	ch_name = cmd->ch_name;

	if (strnlen(cmd->ch_name, maxlen) == maxlen) {

		pr_err("channel name is not NULL terminated\n");

		return -EINVAL;

	}



	pr_debug("ch_name [%s].\n", ch_name);



	ret = spcom_create_channel_chardev(ch_name);
@@ -2584,6 +2578,12 @@ static int spcom_create_channel_chardev(const char *name) 
	void *priv;

	struct cdev *cdev;



	if (!name || strnlen(name, SPCOM_CHANNEL_NAME_SIZE) ==

			SPCOM_CHANNEL_NAME_SIZE) {

		pr_err("invalid channel name\n");

		return -EINVAL;

	}



	pr_debug("Add channel [%s].\n", name);



	ch = spcom_find_channel_by_name(name);
@@ -2605,7 +2605,12 @@ static int spcom_create_channel_chardev(const char *name) 
	spcom_dev->channel_count++;

	devt = spcom_dev->device_no + spcom_dev->channel_count;

	priv = ch;

	dev = device_create(cls, parent, devt, priv, name);



	/*

	 * Pass channel name as formatted string to avoid abuse by using a

	 * formatted string as channel name

	 */

	dev = device_create(cls, parent, devt, priv, "%s", name);

	if (IS_ERR(dev)) {

		pr_err("device_create failed.\n");

		kfree(cdev);