diff options
| author | Marek Behún <marek.behun@nic.cz> | 2020-02-15 15:21:30 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-02-19 19:54:07 +0100 |
| commit | 9fd8d4b53e92f1fb5137d6ab2274dcb219a56523 (patch) | |
| tree | d907b9f839da8577da4d48a92410237e90a73f1d | |
| parent | e94f882389985d10978fe3f4644c038a91c2db87 (diff) | |
| download | linux-9fd8d4b53e92f1fb5137d6ab2274dcb219a56523.tar.gz linux-9fd8d4b53e92f1fb5137d6ab2274dcb219a56523.tar.bz2 linux-9fd8d4b53e92f1fb5137d6ab2274dcb219a56523.zip | |
bus: moxtet: fix potential stack buffer overflow
commit 3bf3c9744694803bd2d6f0ee70a6369b980530fd upstream.
The input_read function declares the size of the hex array relative to
sizeof(buf), but buf is a pointer argument of the function. The hex
array is meant to contain hexadecimal representation of the bin array.
Link: https://lore.kernel.org/r/20200215142130.22743-1-marek.behun@nic.cz
Fixes: 5bc7f990cd98 ("bus: Add support for Moxtet bus")
Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reported-by: sohu0106 <sohu0106@126.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/bus/moxtet.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/bus/moxtet.c b/drivers/bus/moxtet.c index 36cf13eee6b8..68413bf9cf87 100644 --- a/drivers/bus/moxtet.c +++ b/drivers/bus/moxtet.c @@ -466,7 +466,7 @@ static ssize_t input_read(struct file *file, char __user *buf, size_t len, { struct moxtet *moxtet = file->private_data; u8 bin[TURRIS_MOX_MAX_MODULES]; - u8 hex[sizeof(buf) * 2 + 1]; + u8 hex[sizeof(bin) * 2 + 1]; int ret, n; ret = moxtet_spi_read(moxtet, bin); |