scsi: ufs: fix buffer overflow when access descriptor
The descriptor access function has a potential issue. It makes a buffer overflow bug and trigger a kernel panic. Fix the boundary check and return EINVAL when it has an invalid input. log: Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ufs_sysfs_read_desc_param+0x1a4/0x1a4 Call trace: dump_backtrace+0x0/0x1a0 dump_stack+0xbc/0xf8 panic+0x150/0x2d4 clear_warn_once_fops_open+0x0/0x30 lun_write_protect_show+0x0/0x74 Bug: 153344835 Test: adb shell cat /sys/devices/platform/soc/1d84000.ufshc/*_descriptor*/* Change-Id: Ie57cfacc6f7b32f68e1b54bb1cf059d60e6d17c6 Signed-off-by:Leo Liou <leoliou@google.com> [dereference23: Apply to msm-4.14] Signed-off-by:
Alexander Winkowski <dereference23@outlook.com> Signed-off-by:
Pranav Vashi <neobuddy89@gmail.com>
Loading
Please register or sign in to comment