From: Dan Carpenter Date: Wed, 25 Jun 2025 18:57:52 +0000 (-0500) Subject: ACPI: APEI: EINJ: prevent memory corruption in error_type_set() X-Git-Tag: v6.17-rc1~189^2~3^2~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=80744a3bed8ce65071ca6e970a5f8b7c12213d3d;p=thirdparty%2Flinux.git ACPI: APEI: EINJ: prevent memory corruption in error_type_set() The "einj_buf" buffer is 32 chars. If "count" is larger than that it results in memory corruption. Cap it at 31 so that we leave the last character as a NUL terminator. By the way, the highest reasonable value for "count" is 24. Fixes: 0c6176e1e186 ("ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities") Signed-off-by: Dan Carpenter Reviewed-by: Ira Weiny Link: https://patch.msgid.link/ae6286cf-4d73-4b97-8c0f-0782a65b8f51@sabinyo.mountain Signed-off-by: Rafael J. Wysocki --- diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index d6d7e36e36479..f5cfa6310f0e1 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -826,6 +826,10 @@ static ssize_t error_type_set(struct file *file, const char __user *buf, int rc; u64 val; + /* Leave the last character for the NUL terminator */ + if (count > sizeof(einj_buf) - 1) + return -EINVAL; + memset(einj_buf, 0, sizeof(einj_buf)); if (copy_from_user(einj_buf, buf, count)) return -EFAULT;