]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
platform/x86: dell_rbu: Stop overwriting data buffer
authorStuart Hayes <stuart.w.hayes@gmail.com>
Mon, 9 Jun 2025 18:46:58 +0000 (13:46 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 27 Jun 2025 10:05:33 +0000 (11:05 +0100)
commit25375f0d0b6caa815c072ddb10528523d1a84348
tree0408cbff49ca4fee3b03f312ef87013381c75c3d
parent07d7b8e7ef7d1f812a6211ed531947c56d09e95e
platform/x86: dell_rbu: Stop overwriting data buffer

[ Upstream commit f4b0fa38d5fefe9aed6ed831f3bd3538c168ee19 ]

The dell_rbu driver will use memset() to clear the data held by each
packet when it is no longer needed (when the driver is unloaded, the
packet size is changed, etc).

The amount of memory that is cleared (before this patch) is the normal
packet size. However, the last packet in the list may be smaller.

Fix this to only clear the memory actually used by each packet, to prevent
it from writing past the end of data buffer.

Because the packet data buffers are allocated with __get_free_pages() (in
page-sized increments), this bug could only result in a buffer being
overwritten when a packet size larger than one page is used. The only user
of the dell_rbu module should be the Dell BIOS update program, which uses
a packet size of 4096, so no issues should be seen without the patch, it
just blocks the possiblity.

Fixes: 6c54c28e69f2 ("[PATCH] dell_rbu: new Dell BIOS update driver")
Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
Link: https://lore.kernel.org/r/20250609184659.7210-5-stuart.w.hayes@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/platform/x86/dell/dell_rbu.c