Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e548f950 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

platform/chrome: fix memory corruption in ioctl 



[ Upstream commit 8a07b45fd3c2dda24fad43639be5335a4595196a ]

If "s_mem.bytes" is larger than the buffer size it leads to memory
corruption.

Fixes: eda2e30c ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarGuenter Roeck <groeck@chromium.org>
Signed-off-by: default avatarTzung-Bi Shih <tzungbi@kernel.org>
Link: https://lore.kernel.org/r/Yv8dpCFZJdbUT5ye@kili


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 783c1c50

drivers/platform/chrome/cros_ec_chardev.c

+3 −0
Original line number Diff line number Diff line
@@ -328,6 +328,9 @@ static long cros_ec_chardev_ioctl_readmem(struct cros_ec_dev *ec, 
	if (copy_from_user(&s_mem, arg, sizeof(s_mem)))

		return -EFAULT;



	if (s_mem.bytes > sizeof(s_mem.buffer))

		return -EINVAL;



	num = ec_dev->cmd_readmem(ec_dev, s_mem.offset, s_mem.bytes,

				  s_mem.buffer);

	if (num <= 0)