gpio: virtuser: fix potential out-of-bound write

If the caller wrote more characters, count is truncated to the max
available space in "simple_write_to_buffer". Check that the input
size does not exceed the buffer size. Write a zero termination
afterwards.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202505091754.285hHbr2-lkp@intel.com/
Signed-off-by: Markus Burri <markus.burri@mt.com>
Link: https://lore.kernel.org/r/20250509150459.115489-1-markus.burri@mt.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

diff --git a/drivers/gpio/gpio-virtuser.c b/drivers/gpio/gpio-virtuser.c
index 13407fd4f0ebe8fa8c2ea96d2e0cd9da2c98415e..eab6726953b4118dc0d72c2e37daeb9629040d11 100644 (file)
--- a/drivers/gpio/gpio-virtuser.c
+++ b/drivers/gpio/gpio-virtuser.c
@@ -401,10 +401,15 @@ static ssize_t gpio_virtuser_direction_do_write(struct file *file,
        char buf[32], *trimmed;
        int ret, dir, val = 0;
 
-       ret = simple_write_to_buffer(buf, sizeof(buf), ppos, user_buf, count);
+       if (count >= sizeof(buf))
+               return -EINVAL;
+
+       ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
        if (ret < 0)
                return ret;
 
+       buf[ret] = '\0';
+
        trimmed = strim(buf);
 
        if (strcmp(trimmed, "input") == 0) {
@@ -623,12 +628,15 @@ static ssize_t gpio_virtuser_consumer_write(struct file *file,
        char buf[GPIO_VIRTUSER_NAME_BUF_LEN + 2];
        int ret;
 
+       if (count >= sizeof(buf))
+               return -EINVAL;
+
        ret = simple_write_to_buffer(buf, GPIO_VIRTUSER_NAME_BUF_LEN, ppos,
                                     user_buf, count);
        if (ret < 0)
                return ret;
 
-       buf[strlen(buf) - 1] = '\0';
+       buf[ret] = '\0';
 
        ret = gpiod_set_consumer_name(data->ad.desc, buf);
        if (ret)