queue-4.4/drivers-misc-fix-out-of-bounds-access-in-function-pa.patch

   1 From c0d762906f0e8159f550ac891d8fa78e497cbf36 Mon Sep 17 00:00:00 2001
   2 From: Young Xiao <YangX92@hotmail.com>
   3 Date: Fri, 12 Apr 2019 15:45:06 +0800
   4 Subject: Drivers: misc: fix out-of-bounds access in function
   5  param_set_kgdbts_var
   6
   7 [ Upstream commit b281218ad4311a0342a40cb02fb17a363df08b48 ]
   8
   9 There is an out-of-bounds access to "config[len - 1]" array when the
  10 variable "len" is zero.
  11
  12 See commit dada6a43b040 ("kgdboc: fix KASAN global-out-of-bounds bug
  13 in param_set_kgdboc_var()") for details.
  14
  15 Signed-off-by: Young Xiao <YangX92@hotmail.com>
  16 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  17 Signed-off-by: Sasha Levin <sashal@kernel.org>
  18 ---
  19  drivers/misc/kgdbts.c | 4 ++--
  20  1 file changed, 2 insertions(+), 2 deletions(-)
  21
  22 diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
  23 index 99635dd9dbac..bb3a76ad80da 100644
  24 --- a/drivers/misc/kgdbts.c
  25 +++ b/drivers/misc/kgdbts.c
  26 @@ -1132,7 +1132,7 @@ static void kgdbts_put_char(u8 chr)
  27
  28  static int param_set_kgdbts_var(const char *kmessage, struct kernel_param *kp)
  29  {
  30 -       int len = strlen(kmessage);
  31 +       size_t len = strlen(kmessage);
  32
  33         if (len >= MAX_CONFIG_LEN) {
  34                 printk(KERN_ERR "kgdbts: config string too long\n");
  35 @@ -1152,7 +1152,7 @@ static int param_set_kgdbts_var(const char *kmessage, struct kernel_param *kp)
  36
  37         strcpy(config, kmessage);
  38         /* Chop out \n char as a result of echo */
  39 -       if (config[len - 1] == '\n')
  40 +       if (len && config[len - 1] == '\n')
  41                 config[len - 1] = '\0';
  42
  43         /* Go and configure with the new params. */
  44 --
  45 2.20.1
  46