Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 93dde0e1 authored by Srinivasarao P's avatar Srinivasarao P Committed by Gerrit - the friendly Code Review server
Browse files

iommu/iommu-debug: fix buffer overflows in debugfs read functions 



The kernel buffer 'ubuf' can overflow while copying data to user
space in debugfs read functions. Fix it by limiting the length of
data to be copied to userspace.

Change-Id: Ibb3d8c4fb637ddc0e63677ec2dff14a4cf8c0c73
Signed-off-by: default avatarSrinivasarao P <spathi@codeaurora.org>
parent a922c9c6

drivers/iommu/iommu-debug.c

+14 −10
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.

 * Copyright (c) 2015-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1349,6 +1349,7 @@ static ssize_t iommu_debug_dma_attach_read(struct file *file, char __user *ubuf, 
	struct iommu_debug_device *ddev = file->private_data;

	struct device *dev = ddev->dev;

	char c[2];

	size_t buflen = sizeof(c);



	if (*offset)

		return 0;
@@ -1359,13 +1360,14 @@ static ssize_t iommu_debug_dma_attach_read(struct file *file, char __user *ubuf, 
		c[0] = dev->archdata.mapping->domain ? '1' : '0';



	c[1] = '\n';

	if (copy_to_user(ubuf, &c, 2)) {

	buflen = min(count, buflen);

	if (copy_to_user(ubuf, &c, buflen)) {

		pr_err("copy_to_user failed\n");

		return -EFAULT;

	}

	*offset = 1;		/* non-zero means we're done */



	return 2;

	return buflen;

}



static const struct file_operations iommu_debug_dma_attach_fops = {
@@ -1393,7 +1395,7 @@ static ssize_t iommu_debug_test_virt_addr_read(struct file *file, 
	else

		snprintf(buf, buf_len, "0x%pK\n", test_virt_addr);



	buflen = strlen(buf);

	buflen = min(count, strlen(buf)+1);

	if (copy_to_user(ubuf, buf, buflen)) {

		pr_err("Couldn't copy_to_user\n");

		retval = -EFAULT;
@@ -1424,19 +1426,21 @@ static ssize_t iommu_debug_attach_read(struct file *file, char __user *ubuf, 
{

	struct iommu_debug_device *ddev = file->private_data;

	char c[2];

	size_t buflen = sizeof(c);



	if (*offset)

		return 0;



	c[0] = ddev->domain ? '1' : '0';

	c[1] = '\n';

	if (copy_to_user(ubuf, &c, 2)) {

	buflen = min(count, buflen);

	if (copy_to_user(ubuf, &c, buflen)) {

		pr_err("copy_to_user failed\n");

		return -EFAULT;

	}

	*offset = 1;		/* non-zero means we're done */



	return 2;

	return buflen;

}



static const struct file_operations iommu_debug_attach_fops = {
@@ -1514,7 +1518,7 @@ static ssize_t iommu_debug_pte_read(struct file *file, char __user *ubuf, 
	else

		snprintf(buf, sizeof(buf), "pte=%016llx\n", pte);



	buflen = strlen(buf);

	buflen = min(count, strlen(buf)+1);

	if (copy_to_user(ubuf, buf, buflen)) {

		pr_err("Couldn't copy_to_user\n");

		retval = -EFAULT;
@@ -1583,7 +1587,7 @@ static ssize_t iommu_debug_atos_read(struct file *file, char __user *ubuf, 
		snprintf(buf, 100, "%pa\n", &phys);

	}



	buflen = strlen(buf);

	buflen = min(count, strlen(buf)+1);

	if (copy_to_user(ubuf, buf, buflen)) {

		pr_err("Couldn't copy_to_user\n");

		retval = -EFAULT;
@@ -1636,7 +1640,7 @@ static ssize_t iommu_debug_dma_atos_read(struct file *file, char __user *ubuf, 
	else

		snprintf(buf, sizeof(buf), "%pa\n", &phys);



	buflen = strlen(buf);

	buflen = min(count, strlen(buf)+1);

	if (copy_to_user(ubuf, buf, buflen)) {

		pr_err("Couldn't copy_to_user\n");

		retval = -EFAULT;
@@ -1869,7 +1873,7 @@ static ssize_t iommu_debug_dma_map_read(struct file *file, char __user *ubuf, 
	iova = ddev->iova;

	snprintf(buf, sizeof(buf), "%pa\n", &iova);



	buflen = strlen(buf);

	buflen = min(count, strlen(buf)+1);

	if (copy_to_user(ubuf, buf, buflen)) {

		pr_err("Couldn't copy_to_user\n");

		retval = -EFAULT;