Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d582f72d authored by Liron Daniel's avatar Liron Daniel Committed by Gerrit - the friendly Code Review server
Browse files

soc: qcom: spcom: Pass channel name as formatted string to device_create 



Pass channel name as formmated string to device_create call in
spcom_create_channel_chardevto prevent memory access issues when using
formatted string as channel name.

Change-Id: I549087a49e97f0b1a66ea5816eabfe80a6f7f1f7
Signed-off-by: default avatarLiron Daniel <lirond@codeaurora.org>
parent 4e1c68c5

drivers/soc/qcom/spcom.c

+12 −7
Original line number Diff line number Diff line
@@ -597,7 +597,6 @@ static int spcom_handle_create_channel_command(void *cmd_buf, int cmd_size) 
{

	int ret = 0;

	struct spcom_user_create_channel_command *cmd = cmd_buf;

	const size_t maxlen = sizeof(cmd->ch_name);



	if (cmd_size != sizeof(*cmd)) {

		spcom_pr_err("cmd_size [%d] , expected [%d]\n",
@@ -605,11 +604,6 @@ static int spcom_handle_create_channel_command(void *cmd_buf, int cmd_size) 
		return -EINVAL;

	}



	if (strnlen(cmd->ch_name, maxlen) == maxlen) {

		spcom_pr_err("channel name is not NULL terminated\n");

		return -EINVAL;

	}



	ret = spcom_create_channel_chardev(cmd->ch_name, cmd->is_sharable);



	return ret;
@@ -2002,6 +1996,12 @@ static int spcom_create_channel_chardev(const char *name, bool is_sharable) 
	void *priv;

	struct cdev *cdev;



	if (!name || strnlen(name, SPCOM_CHANNEL_NAME_SIZE) ==

			SPCOM_CHANNEL_NAME_SIZE) {

		spcom_pr_err("invalid channel name\n");

		return -EINVAL;

	}



	spcom_pr_dbg("creating channel [%s]\n", name);

	mutex_lock(&spcom_dev->create_channel_lock);
@@ -2040,7 +2040,12 @@ static int spcom_create_channel_chardev(const char *name, bool is_sharable) 


	devt = spcom_dev->device_no + atomic_read(&spcom_dev->chdev_count);

	priv = ch;

	dev = device_create(cls, parent, devt, priv, name);



	/*

	 * Pass channel name as formatted string to avoid abuse by using a

	 * formatted string as channel name

	 */

	dev = device_create(cls, parent, devt, priv, "%s", name);

	if (IS_ERR(dev)) {

		spcom_pr_err("device_create failed\n");

		ret = -ENODEV;