[PATCH 4.8 007/140] spi: spidev_test: Fix buffer overflow in unescape()

From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 4.8 007/140] spi: spidev_test: Fix buffer overflow in unescape()
Date	2016-10-26 15:30 +0200
Message-ID	<swwrh-4gI-59@gated-at.bofh.it> (permalink)
References	<swvvb-3zX-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

4.8-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <geert+renesas@glider.be>

commit 0278b34bf15f8d8a609595b15909cd8622dd64ca upstream.

Sometimes spidev_test crashes with:

    *** Error in `spidev_test': munmap_chunk(): invalid pointer: 0x00022020 ***
    Aborted

or just

    Segmentation fault

This is due to transfer_escaped_string() miscalculating the required
size of the buffer by one byte, causing a buffer overflow in unescape().

Drop the bogus "+ 1" in the strlen() parameter to fix this.

Note that unescape() never copies the zero-terminator of the source
string, so it writes at most as many bytes as the length of the source
string.

Fixes: 30061915be6e3a2c (spi: spidev_test: Added input buffer from the terminal)
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 tools/spi/spidev_test.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/tools/spi/spidev_test.c
+++ b/tools/spi/spidev_test.c
@@ -284,7 +284,7 @@ static void parse_opts(int argc, char *a
 
 static void transfer_escaped_string(int fd, char *str)
 {
-	size_t size = strlen(str + 1);
+	size_t size = strlen(str);
 	uint8_t *tx;
 	uint8_t *rx;

Thread

[PATCH 4.8 000/140] 4.8.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 058/140] zfcp: fix payload trace length for SAN request&response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 043/140] powerpc/mm: Update FORCE_MAX_ZONEORDER range to allow hugetlb w/4K Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 065/140] [media] mb86a20s: fix demod settings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 076/140] NFSD: fix corruption in notifier registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 009/140] ath10k: fix copy engine 5 destination ring stuck Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 044/140] powerpc/64: Fix incorrect return value from __copy_tofrom_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 042/140] powerpc/powernv: Use CPU-endian PEST in pnv_pci_dump_p7ioc_diag_data() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 045/140] powerpc/pseries: Fix stack corruption in htpe code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 064/140] [media] mb86a20s: fix the locking logic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 007/140] spi: spidev_test: Fix buffer overflow in unescape() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 073/140] Input: elantech - force needed quirks on Fujitsu H760 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 050/140] zfcp: fix fc_host port_type with NPIV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 049/140] ubi: Deal with interrupted erasures in WL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 040/140] powerpc/eeh: Null check uses of eeh_pe_bus_get Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 052/140] zfcp: close window with unblocked rport during rport gone Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 038/140] powerpc/vdso64: Use double word compare on pointers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 047/140] IB/srp: Fix infinite loop when FMR sg[0].offset != 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 060/140] scsi: zfcp: spin_lock_irqsave() is not nestable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 071/140] MIPS: ptrace: Fix regs_return_value for kernel context Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 054/140] zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:30 +0200
  [PATCH 4.8 019/140] cpufreq: intel_pstate: Fix unsafe HWP MSR access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 023/140] parisc: Fix kernel memory layout regarding position of __gp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 018/140] cpufreq: skip invalid entries when searching the frequency Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 015/140] platform: dont return 0 from platform_get_irq[_byname]() on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 036/140] dm crypt: fix crash on exit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 022/140] parisc: Fix self-detected CPU stall warnings on Mako machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 025/140] pstore/ramoops: fixup driver removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 021/140] parisc: Increase KERNEL_INITIAL_SIZE for 32-bit SMP kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 030/140] perf intel-pt: Fix estimated timestamps for cycle-accurate mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 034/140] dm rq: take request_queue lock while clearing QUEUE_FLAG_STOPPED Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 017/140] cpufreq: conservative: Fix next frequency selection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 005/140] clk: imx6: initialize GPU clocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 028/140] pstore/ram: Use memcpy_fromio() to save old buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 031/140] perf intel-pt: Fix MTC timestamp calculation for large MTC periods Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  [PATCH 4.8 033/140] dm: return correct error code in dm_resume()s retry loop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-26 15:40 +0200
  Re: [PATCH 4.8 000/140] 4.8.5-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-10-26 20:50 +0200
  Re: [PATCH 4.8 000/140] 4.8.5-stable review Guenter Roeck <linux@roeck-us.net> - 2016-10-26 23:50 +0200

csiph-web