mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-04 08:08:54 +00:00
Code Issues Releases Wiki Activity

octeontx2-af: debugfs: don't corrupt user memory

Browse source 
The user supplies the "count" value to say how big its read buffer is.
The rvu_dbg_lmtst_map_table_display() function does not take the "count"
into account but instead just copies the whole table, potentially
corrupting the user's data.

Introduce the "ret" variable to store how many bytes we can copy.  Also
I changed the type of "off" to size_t to make using min() simpler.

Fixes: 0daa55d033 ("octeontx2-af: cn10k: debugfs for dumping LMTST map table")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20211117073454.GD5237@kili
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Dan Carpenter 2021-11-17 10:34:54 +03:00 committed by Jakub Kicinski
parent 48b71a9e66
commit a280ef90af
1 changed files with 10 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
View file

@ -236,10 +236,11 @@ static ssize_t rvu_dbg_lmtst_map_table_display(struct file *filp,
u64 lmt_addr, val, tbl_base;
int pf, vf, num_vfs, hw_vfs;
void __iomem *lmt_map_base;
int index = 0, off = 0;
int bytes_not_copied;
int buf_size = 10240;
size_t off = 0;
int index = 0;
char *buf;
int ret;
/* don't allow partial reads */
if (*ppos != 0)
@ -303,15 +304,17 @@ static ssize_t rvu_dbg_lmtst_map_table_display(struct file *filp,
}
off += scnprintf(&buf[off], buf_size - 1 - off, "\n");
bytes_not_copied = copy_to_user(buffer, buf, off);
ret = min(off, count);
if (copy_to_user(buffer, buf, ret))
ret = -EFAULT;
kfree(buf);
iounmap(lmt_map_base);
if (bytes_not_copied)
return -EFAULT;
if (ret < 0)
return ret;
*ppos = off;
return off;
*ppos = ret;
return ret;
}
RVU_DEBUG_FOPS(lmtst_map_table, lmtst_map_table_display, NULL);