mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 14:19:16 +00:00
NTB: ntb_tool: uninitialized heap data in tool_fn_write()
commit45e1058b77
upstream. The call to: ret = simple_write_to_buffer(buf, size, offp, ubuf, size); will return success if it is able to write even one byte to "buf". The value of "*offp" controls which byte. This could result in reading uninitialized data when we do the sscanf() on the next line. This code is not really desigined to handle partial writes where *offp is non-zero and the "buf" is preserved and re-used between writes. Just ban partial writes and replace the simple_write_to_buffer() with copy_from_user(). Fixes:578b881ba9
("NTB: Add tool test client") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Jon Mason <jdmason@kudzu.us> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
7eec34ddcb
commit
582565415f
1 changed files with 5 additions and 3 deletions
|
@ -367,14 +367,16 @@ static ssize_t tool_fn_write(struct tool_ctx *tc,
|
||||||
u64 bits;
|
u64 bits;
|
||||||
int n;
|
int n;
|
||||||
|
|
||||||
|
if (*offp)
|
||||||
|
return 0;
|
||||||
|
|
||||||
buf = kmalloc(size + 1, GFP_KERNEL);
|
buf = kmalloc(size + 1, GFP_KERNEL);
|
||||||
if (!buf)
|
if (!buf)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
|
||||||
ret = simple_write_to_buffer(buf, size, offp, ubuf, size);
|
if (copy_from_user(buf, ubuf, size)) {
|
||||||
if (ret < 0) {
|
|
||||||
kfree(buf);
|
kfree(buf);
|
||||||
return ret;
|
return -EFAULT;
|
||||||
}
|
}
|
||||||
|
|
||||||
buf[size] = 0;
|
buf[size] = 0;
|
||||||
|
|
Loading…
Reference in a new issue