Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 26bec322 authored by Leo Liou's avatar Leo Liou Committed by Pranav Vashi
Browse files

scsi: ufs: fix buffer overflow when access descriptor



The descriptor access function has a potential issue. It makes a
buffer overflow bug and trigger a kernel panic. Fix the boundary check
and return EINVAL when it has an invalid input.

log:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted
    in: ufs_sysfs_read_desc_param+0x1a4/0x1a4
Call trace:
 dump_backtrace+0x0/0x1a0
 dump_stack+0xbc/0xf8
 panic+0x150/0x2d4
 clear_warn_once_fops_open+0x0/0x30
 lun_write_protect_show+0x0/0x74

Bug: 153344835
Test: adb shell cat /sys/devices/platform/soc/1d84000.ufshc/*_descriptor*/*
Change-Id: Ie57cfacc6f7b32f68e1b54bb1cf059d60e6d17c6
Signed-off-by: default avatarLeo Liou <leoliou@google.com>
[dereference23: Apply to msm-4.14]
Signed-off-by: default avatarAlexander Winkowski <dereference23@outlook.com>
Signed-off-by: default avatarPranav Vashi <neobuddy89@gmail.com>
parent f11fad92
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment