Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b4c23305 authored by Dan Carpenter's avatar Dan Carpenter Committed by Brian Norris
Browse files

mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes() 



We always put a NUL terminator one space past the end of the "vendor"
buffer.  Walter Harms also pointed out that this should just use
kstrndup().

Fixes: 7d17c02a ('mtd: Add new SmartMedia/xD FTL')

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarBrian Norris <computersforpeace@gmail.com>
parent f5e00838

drivers/mtd/sm_ftl.c

+4 −7
Original line number Diff line number Diff line
@@ -59,15 +59,12 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl) 
	struct attribute_group *attr_group;

	struct attribute **attributes;

	struct sm_sysfs_attribute *vendor_attribute;

	char *vendor;



	int vendor_len = strnlen(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,

					SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET);



	char *vendor = kmalloc(vendor_len, GFP_KERNEL);

	vendor = kstrndup(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,

			  SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET, GFP_KERNEL);

	if (!vendor)

		goto error1;

	memcpy(vendor, ftl->cis_buffer + SM_CIS_VENDOR_OFFSET, vendor_len);

	vendor[vendor_len] = 0;



	/* Initialize sysfs attributes */

	vendor_attribute =
@@ -78,7 +75,7 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl) 
	sysfs_attr_init(&vendor_attribute->dev_attr.attr);



	vendor_attribute->data = vendor;

	vendor_attribute->len = vendor_len;

	vendor_attribute->len = strlen(vendor);

	vendor_attribute->dev_attr.attr.name = "vendor";

	vendor_attribute->dev_attr.attr.mode = S_IRUGO;

	vendor_attribute->dev_attr.show = sm_attr_show;