scsi: ufs: fix buffer overflow when access descriptor
The descriptor access function has a potential issue. It makes a
buffer overflow bug and trigger a kernel panic. Fix the boundary check
and return EINVAL when it has an invalid input.
log:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted
in: ufs_sysfs_read_desc_param+0x1a4/0x1a4
Call trace:
dump_backtrace+0x0/0x1a0
dump_stack+0xbc/0xf8
panic+0x150/0x2d4
clear_warn_once_fops_open+0x0/0x30
lun_write_protect_show+0x0/0x74
Bug: 153344835
Test: adb shell cat /sys/devices/platform/soc/1d84000.ufshc/*_descriptor*/*
Change-Id: Ie57cfacc6f7b32f68e1b54bb1cf059d60e6d17c6
Signed-off-by:
Leo Liou <leoliou@google.com>
[dereference23: Apply to msm-4.14]
Signed-off-by:
Alexander Winkowski <dereference23@outlook.com>
Signed-off-by:
Pranav Vashi <neobuddy89@gmail.com>
Loading
Please register or sign in to comment