From patchwork Sat Feb 15 14:21:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Marek_Beh=C3=BAn?= X-Patchwork-Id: 11383875 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8CD521580 for ; Sat, 15 Feb 2020 14:29:43 +0000 (UTC) Received: from web01.groups.io (web01.groups.io [66.175.222.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 2683B2086A for ; Sat, 15 Feb 2020 14:29:43 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=linux.kernel.org header.i=@linux.kernel.org header.b="j06fYuhN" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2683B2086A Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=nic.cz Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=bounce+26986+1391+1554929+3438807@linux.kernel.org X-Received: by 127.0.0.2 with SMTP id RTlCYY1556264xCAxDMPHulp; Sat, 15 Feb 2020 06:29:42 -0800 X-Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by mx.groups.io with SMTP id smtpd.web11.8518.1581776982102618238 for ; Sat, 15 Feb 2020 06:29:42 -0800 X-Received: by mail.kernel.org (Postfix) id A7E762187F; Sat, 15 Feb 2020 14:29:41 +0000 (UTC) X-Greylist: delayed 487 seconds by postgrey-1.34 at mail.kernel.org; Sat, 15 Feb 2020 14:29:40 UTC DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D87622086A X-Received: from mail.nic.cz (mail.nic.cz [217.31.204.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id D87622086A; Sat, 15 Feb 2020 14:29:40 +0000 (UTC) X-Received: from dellmb.labs.office.nic.cz (unknown [IPv6:2001:1488:fffe:6:cac7:3539:7f1f:463]) by mail.nic.cz (Postfix) with ESMTP id 831D8140EB4; Sat, 15 Feb 2020 15:21:31 +0100 (CET) From: =?utf-8?q?Marek_Beh=C3=BAn?= To: Linuxkernel+Patchwork-Soc via Email Integration Cc: arm@kernel.org, soc@kernel.org, =?utf-8?q?Marek_Beh=C3=BAn?= , sohu0106 Subject: [PATCH mvebu] bus: moxtet: fix potential stack buffer overflow Date: Sat, 15 Feb 2020 15:21:30 +0100 Message-Id: <20200215142130.22743-1-marek.behun@nic.cz> MIME-Version: 1.0 X-Virus-Scanned: clamav-milter 0.101.4 at mail X-Virus-Status: Clean X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED,SHORTCIRCUIT shortcircuit=ham autolearn=disabled version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mail.nic.cz Precedence: Bulk List-Unsubscribe: Sender: patchwork-soc@linux.kernel.org List-Id: Mailing-List: list patchwork-soc@linux.kernel.org; contact patchwork-soc+owner@linux.kernel.org Delivered-To: mailing list patchwork-soc@linux.kernel.org Reply-To: patchwork-soc+owner@linux.kernel.org X-Gm-Message-State: YNpw82SMixIhcSkMQcYPmkE2x1554929AA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux.kernel.org; q=dns/txt; s=20140610; t=1581776982; bh=+HgMRefT+U8OA+01pUVVyv4n3fWu+h3E4n5leab3pnw=; h=Cc:Content-Type:Date:From:Reply-To:Subject:To; b=j06fYuhNFSnC1X6McdMWJjBn33fL/ppSm4UGeTQg27eOZTsFhXU/DUr9GojOlCp29KK DeNAxJswE1jS/lfCNN3nlYTMUeOeFTlBH3CZKCMe35C1+pkZYAv0FiBGIkNfqFikPOOPG oMMlStYpHbn/2Dg8TdmQyBR/cwKSeAbIjg0= The input_read function declares the size of the hex array relative to sizeof(buf), but buf is a pointer argument of the function. The hex array is meant to contain hexadecimal representation of the bin array. Fixes: 5bc7f990cd98 ("bus: Add support for Moxtet bus") Signed-off-by: Marek Behún Reported-by: sohu0106 --- drivers/bus/moxtet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/bus/moxtet.c b/drivers/bus/moxtet.c index 15fa293819a0..b20fdcbd035b 100644 --- a/drivers/bus/moxtet.c +++ b/drivers/bus/moxtet.c @@ -465,7 +465,7 @@ static ssize_t input_read(struct file *file, char __user *buf, size_t len, { struct moxtet *moxtet = file->private_data; u8 bin[TURRIS_MOX_MAX_MODULES]; - u8 hex[sizeof(buf) * 2 + 1]; + u8 hex[sizeof(bin) * 2 + 1]; int ret, n; ret = moxtet_spi_read(moxtet, bin);