]>
Commit | Line | Data |
---|---|---|
822c92c5 SL |
1 | From c0d762906f0e8159f550ac891d8fa78e497cbf36 Mon Sep 17 00:00:00 2001 |
2 | From: Young Xiao <YangX92@hotmail.com> | |
3 | Date: Fri, 12 Apr 2019 15:45:06 +0800 | |
4 | Subject: Drivers: misc: fix out-of-bounds access in function | |
5 | param_set_kgdbts_var | |
6 | ||
7 | [ Upstream commit b281218ad4311a0342a40cb02fb17a363df08b48 ] | |
8 | ||
9 | There is an out-of-bounds access to "config[len - 1]" array when the | |
10 | variable "len" is zero. | |
11 | ||
12 | See commit dada6a43b040 ("kgdboc: fix KASAN global-out-of-bounds bug | |
13 | in param_set_kgdboc_var()") for details. | |
14 | ||
15 | Signed-off-by: Young Xiao <YangX92@hotmail.com> | |
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
17 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
18 | --- | |
19 | drivers/misc/kgdbts.c | 4 ++-- | |
20 | 1 file changed, 2 insertions(+), 2 deletions(-) | |
21 | ||
22 | diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c | |
23 | index 99635dd9dbac..bb3a76ad80da 100644 | |
24 | --- a/drivers/misc/kgdbts.c | |
25 | +++ b/drivers/misc/kgdbts.c | |
26 | @@ -1132,7 +1132,7 @@ static void kgdbts_put_char(u8 chr) | |
27 | ||
28 | static int param_set_kgdbts_var(const char *kmessage, struct kernel_param *kp) | |
29 | { | |
30 | - int len = strlen(kmessage); | |
31 | + size_t len = strlen(kmessage); | |
32 | ||
33 | if (len >= MAX_CONFIG_LEN) { | |
34 | printk(KERN_ERR "kgdbts: config string too long\n"); | |
35 | @@ -1152,7 +1152,7 @@ static int param_set_kgdbts_var(const char *kmessage, struct kernel_param *kp) | |
36 | ||
37 | strcpy(config, kmessage); | |
38 | /* Chop out \n char as a result of echo */ | |
39 | - if (config[len - 1] == '\n') | |
40 | + if (len && config[len - 1] == '\n') | |
41 | config[len - 1] = '\0'; | |
42 | ||
43 | /* Go and configure with the new params. */ | |
44 | -- | |
45 | 2.20.1 | |
46 |