mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-08 09:39:40 +00:00
Code Issues Releases Wiki Activity

thermal/core: Potential buffer overflow in thermal_build_list_of_policies()

Browse source 
[ Upstream commit 1bb30b20b4 ]

After printing the list of thermal governors, then this function prints
a newline character.  The problem is that "size" has not been updated
after printing the last governor.  This means that it can write one
character (the NUL terminator) beyond the end of the buffer.

Get rid of the "size" variable and just use "PAGE_SIZE - count" directly.

Fixes: 1b4f48494e ("thermal: core: group functions related to governor handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210916131342.GB25094@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dan Carpenter 2021-09-16 16:13:42 +03:00 committed by Greg Kroah-Hartman
parent 215df43499
commit 8cba4c2698
1 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
drivers/thermal/thermal_core.c
View file

@ -224,15 +224,14 @@ int thermal_build_list_of_policies(char *buf)
{
struct thermal_governor *pos;
ssize_t count = 0;
ssize_t size = PAGE_SIZE;
mutex_lock(&thermal_governor_lock);
list_for_each_entry(pos, &thermal_governor_list, governor_list) {
size = PAGE_SIZE - count;
count += scnprintf(buf + count, size, "%s ", pos->name);
count += scnprintf(buf + count, PAGE_SIZE - count, "%s ",
pos->name);
}
count += scnprintf(buf + count, size, "\n");
count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
mutex_unlock(&thermal_governor_lock);