mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 21:33:52 +00:00
iio: cros_ec: Fix the allocation size for cros_ec_command
commit8a4629055e
upstream. The struct cros_ec_command contains several integer fields and a trailing array. An allocation size neglecting the integer fields can lead to buffer overrun. Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org> Signed-off-by: Yiyuan Guo <yguoaz@gmail.com> Fixes:974e6f02e2
("iio: cros_ec_sensors_core: Add common functions for the ChromeOS EC Sensor Hub.") Link: https://lore.kernel.org/r/20230630143719.1513906-1-yguoaz@gmail.com Cc: <Stable@vger.kerenl.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
d2c539c216
commit
182f0e71ff
1 changed files with 1 additions and 1 deletions
|
@ -99,7 +99,7 @@ int cros_ec_sensors_core_init(struct platform_device *pdev,
|
|||
platform_set_drvdata(pdev, indio_dev);
|
||||
|
||||
state->ec = ec->ec_dev;
|
||||
state->msg = devm_kzalloc(&pdev->dev,
|
||||
state->msg = devm_kzalloc(&pdev->dev, sizeof(*state->msg) +
|
||||
max((u16)sizeof(struct ec_params_motion_sense),
|
||||
state->ec->max_response), GFP_KERNEL);
|
||||
if (!state->msg)
|
||||
|
|
Loading…
Reference in a new issue