Merge "iommu/iommu-debug: fix buffer overflows in debugfs read functions" (ebf44d36) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/iommu/iommu-debug.c

+14 −10

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
		* Copyright (c) 2015-2019, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -1349,6 +1349,7 @@ static ssize_t iommu_debug_dma_attach_read(struct file file, char __user ubuf,
		struct iommu_debug_device *ddev = file->private_data;
		struct device *dev = ddev->dev;
		char c[2];
		size_t buflen = sizeof(c);

		if (*offset)
		return 0;
		@@ -1359,13 +1360,14 @@ static ssize_t iommu_debug_dma_attach_read(struct file file, char __user ubuf,
		c[0] = dev->archdata.mapping->domain ? '1' : '0';

		c[1] = '\n';
		if (copy_to_user(ubuf, &c, 2)) {
		buflen = min(count, buflen);
		if (copy_to_user(ubuf, &c, buflen)) {
		pr_err("copy_to_user failed\n");
		return -EFAULT;
		}
		offset = 1; / non-zero means we're done */

		return 2;
		return buflen;
		}

		static const struct file_operations iommu_debug_dma_attach_fops = {
		@@ -1393,7 +1395,7 @@ static ssize_t iommu_debug_test_virt_addr_read(struct file *file,
		else
		snprintf(buf, buf_len, "0x%pK\n", test_virt_addr);

		buflen = strlen(buf);
		buflen = min(count, strlen(buf)+1);
		if (copy_to_user(ubuf, buf, buflen)) {
		pr_err("Couldn't copy_to_user\n");
		retval = -EFAULT;
		@@ -1424,19 +1426,21 @@ static ssize_t iommu_debug_attach_read(struct file file, char __user ubuf,
		{
		struct iommu_debug_device *ddev = file->private_data;
		char c[2];
		size_t buflen = sizeof(c);

		if (*offset)
		return 0;

		c[0] = ddev->domain ? '1' : '0';
		c[1] = '\n';
		if (copy_to_user(ubuf, &c, 2)) {
		buflen = min(count, buflen);
		if (copy_to_user(ubuf, &c, buflen)) {
		pr_err("copy_to_user failed\n");
		return -EFAULT;
		}
		offset = 1; / non-zero means we're done */

		return 2;
		return buflen;
		}

		static const struct file_operations iommu_debug_attach_fops = {
		@@ -1514,7 +1518,7 @@ static ssize_t iommu_debug_pte_read(struct file file, char __user ubuf,
		else
		snprintf(buf, sizeof(buf), "pte=%016llx\n", pte);

		buflen = strlen(buf);
		buflen = min(count, strlen(buf)+1);
		if (copy_to_user(ubuf, buf, buflen)) {
		pr_err("Couldn't copy_to_user\n");
		retval = -EFAULT;
		@@ -1583,7 +1587,7 @@ static ssize_t iommu_debug_atos_read(struct file file, char __user ubuf,
		snprintf(buf, 100, "%pa\n", &phys);
		}

		buflen = strlen(buf);
		buflen = min(count, strlen(buf)+1);
		if (copy_to_user(ubuf, buf, buflen)) {
		pr_err("Couldn't copy_to_user\n");
		retval = -EFAULT;
		@@ -1636,7 +1640,7 @@ static ssize_t iommu_debug_dma_atos_read(struct file file, char __user ubuf,
		else
		snprintf(buf, sizeof(buf), "%pa\n", &phys);

		buflen = strlen(buf);
		buflen = min(count, strlen(buf)+1);
		if (copy_to_user(ubuf, buf, buflen)) {
		pr_err("Couldn't copy_to_user\n");
		retval = -EFAULT;
		@@ -1869,7 +1873,7 @@ static ssize_t iommu_debug_dma_map_read(struct file file, char __user ubuf,
		iova = ddev->iova;
		snprintf(buf, sizeof(buf), "%pa\n", &iova);

		buflen = strlen(buf);
		buflen = min(count, strlen(buf)+1);
		if (copy_to_user(ubuf, buf, buflen)) {
		pr_err("Couldn't copy_to_user\n");
		retval = -EFAULT;