Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1728927

[PATCH 4.13 45/47] of/device: Prevent buffer overflow in of_device_modalias()

Show all headers | View raw

4.13-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bjorn Andersson <bjorn.andersson@linaro.org>

commit 08ab58d9de3eb8498ae0585001d0975e46217a39 upstream.

As of_device_get_modalias() returns the number of bytes that would have
been written to the target string, regardless of how much did fit in the
buffer, it's possible that the returned index points beyond the buffer
passed to of_device_modalias() - causing memory beyond the buffer to be
null terminated.

Fixes: 0634c2958927 ("of: Add function for generating a DT modalias with a newline")
Cc: Rob Herring <robh@kernel.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/of/device.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -274,6 +274,8 @@ ssize_t of_device_modalias(struct device
 	ssize_t sl = of_device_get_modalias(dev, str, len - 2);
 	if (sl < 0)
 		return sl;
+	if (sl > len - 2)
+		return -ENOMEM;
 
 	str[sl++] = '\n';
 	str[sl] = 0;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.13 00/47] 4.13.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 14/47] iio: adc: ti-ads1015: enable conversion when CONFIG_PM is not set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 10/47] staging: ccree: save ciphertext for CTS IV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 24/47] fpga: altera-hps2fpga: fix multiple init of l3_remap_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 12/47] iio: adc: ti-ads1015: fix incorrect data rate setting update Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 42/47] cs5536: add support for IDE controller variant Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 16/47] iio: adc: ti-ads1015: dont return invalid value from buffer setup callbacks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 33/47] iwlwifi: pci: add new PCI ID for 7265D Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 36/47] MCB: add support for SC31 to mcb-lpc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 41/47] ahci: dont use MSI for devices with the silly Intel NVMe remapping scheme Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 09/47] staging/rts5208: fix incorrect shift to extract upper nybble Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 35/47] mwifiex: correct channel stat buffer overflows Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 39/47] drm/nouveau: Fix error handling in nv50_disp_atomic_commit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 01/47] usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 40/47] workqueue: Fix flag collision Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 19/47] HID: wacom: Do not completely map WACOM_HID_WD_TOUCHRINGSTATUS usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 18/47] driver core: bus: Fix a potential double free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 37/47] s390/mm: avoid empty zero pages for KVM guests to avoid postcopy hangs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 23/47] thunderbolt: Fix reset response_type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 25/47] intel_th: pci: Add Cannon Lake PCH-H support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 44/47] scsi: sg: recheck MMAP_IO request length with lock held Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 46/47] rtlwifi: Fix memory leak when firmware request fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 31/47] rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 28/47] drm/vgem: Pin our pages for dmabuf exports Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 38/47] drm/nouveau/pci/msi: disable MSI on big-endian platforms by default Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 26/47] intel_th: pci: Add Cannon Lake PCH-LP support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 27/47] ath10k: fix memory leak in rx ring buffer allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 47/47] rtlwifi: Fix fallback firmware loading Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 43/47] scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 45/47] of/device: Prevent buffer overflow in of_device_modalias() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 32/47] Bluetooth: Add support of 13d3:3494 RTL8723BE device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 20/47] binder: free memory on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 15/47] iio: adc: ti-ads1015: avoid getting stale result after runtime resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 03/47] usb: Add device quirk for Logitech HD Pro Webcam C920-C Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 13/47] iio: adc: ti-ads1015: fix scale information for ADS1115 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 08/47] USB: core: Avoid race of async_completed() w/ usbdev_release() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 04/47] usb:xhci:Fix regression when ATI chipsets detected Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 05/47] USB: musb: fix external abort on suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 07/47] ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 17/47] iio: adc: ti-ads1015: add adequate wait time to get correct conversion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 06/47] ANDROID: binder: add padding to binder_fd_array_object. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 02/47] USB: serial: option: add support for D-Link DWM-157 C1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  Re: [PATCH 4.13 00/47] 4.13.1-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-09-08 19:00 +0200
    Re: [PATCH 4.13 00/47] 4.13.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-09 07:50 +0200
  Re: [PATCH 4.13 00/47] 4.13.1-stable review Guenter Roeck <linux@roeck-us.net> - 2017-09-09 15:50 +0200
    Re: [PATCH 4.13 00/47] 4.13.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-09 16:20 +0200

csiph-web