releases/4.9.175/staging-greybus-power_supply-fix-prop-descriptor-request-size.patch

   1 From 47830c1127ef166af787caf2f871f23089610a7f Mon Sep 17 00:00:00 2001
   2 From: Johan Hovold <johan@kernel.org>
   3 Date: Thu, 4 Apr 2019 08:53:30 +0200
   4 Subject: staging: greybus: power_supply: fix prop-descriptor request size
   5
   6 From: Johan Hovold <johan@kernel.org>
   7
   8 commit 47830c1127ef166af787caf2f871f23089610a7f upstream.
   9
  10 Since moving the message buffers off the stack, the dynamically
  11 allocated get-prop-descriptor request buffer is incorrectly sized due to
  12 using the pointer rather than request-struct size when creating the
  13 operation.
  14
  15 Fortunately, the pointer size is always larger than this one-byte
  16 request, but this could still cause trouble on the remote end due to the
  17 unexpected message size.
  18
  19 Fixes: 9d15134d067e ("greybus: power_supply: rework get descriptors")
  20 Cc: stable <stable@vger.kernel.org>     # 4.9
  21 Cc: Rui Miguel Silva <rui.silva@linaro.org>
  22 Signed-off-by: Johan Hovold <johan@kernel.org>
  23 Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com>
  24 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25
  26 ---
  27  drivers/staging/greybus/power_supply.c |    2 +-
  28  1 file changed, 1 insertion(+), 1 deletion(-)
  29
  30 --- a/drivers/staging/greybus/power_supply.c
  31 +++ b/drivers/staging/greybus/power_supply.c
  32 @@ -521,7 +521,7 @@ static int gb_power_supply_prop_descript
  33
  34         op = gb_operation_create(connection,
  35                                  GB_POWER_SUPPLY_TYPE_GET_PROP_DESCRIPTORS,
  36 -                                sizeof(req), sizeof(*resp) + props_count *
  37 +                                sizeof(*req), sizeof(*resp) + props_count *
  38                                  sizeof(struct gb_power_supply_props_desc),
  39                                  GFP_KERNEL);
  40         if (!op)