mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-13 14:14:37 +00:00
Code Issues Releases Wiki Activity

staging:iio:kfifo_buf: Fix potential buffer overflow in iio_read_first_n_kfifo

Browse source 
n is the number of bytes to read, not the number of samples. So if there is
enough data available we will write to the userspace buffer beyond its bounds.
Fix this by copying n bytes maximum. Also round n down to the next multiple of
the sample size, so we will only read complete samples. If the buffer is too
small to hold at least one sample return -EINVAL.

Also update the documentation of read_first_n to reflect the fact that 'n' is
supposed to be in bytes and not in samples.

Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Lars-Peter Clausen 2011-12-12 09:33:14 +01:00 committed by Greg Kroah-Hartman
parent 641b4bb5f1
commit 8fe64955e4
2 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/staging/iio/buffer.h
View file

@ -21,7 +21,7 @@ struct iio_buffer;
* @mark_in_use: reference counting, typically to prevent module removal
* @unmark_in_use: reduce reference count when no longer using buffer
* @store_to: actually store stuff to the buffer
* @read_first_n: try to get a specified number of elements (must exist)
* @read_first_n: try to get a specified number of bytes (must exist)
* @mark_param_change: notify buffer that some relevant parameter has changed
* Often this means the underlying storage may need to
* change.

6
drivers/staging/iio/kfifo_buf.c
View file

@ -160,7 +160,11 @@ static int iio_read_first_n_kfifo(struct iio_buffer *r,
int ret, copied;
struct iio_kfifo *kf = iio_to_kfifo(r);
ret = kfifo_to_user(&kf->kf, buf, r->bytes_per_datum*n, &copied);
if (n < r->bytes_per_datum)
return -EINVAL;
n = rounddown(n, r->bytes_per_datum);
ret = kfifo_to_user(&kf->kf, buf, n, &copied);
return copied;
}