| From b1a33adf60ee82527d325ffe6bded635776204b6 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 7 Jul 2020 16:43:50 +0200 |
| Subject: usb: core: fix quirks_param_set() writing to a const pointer |
| |
| From: Kars Mulder <kerneldev@karsmulder.nl> |
| |
| [ Upstream commit b1b6bed3b5036509b449b5965285d5057ba42527 ] |
| |
| The function quirks_param_set() takes as argument a const char* pointer |
| to the new value of the usbcore.quirks parameter. It then casts this |
| pointer to a non-const char* pointer and passes it to the strsep() |
| function, which overwrites the value. |
| |
| Fix this by creating a copy of the value using kstrdup() and letting |
| that copy be written to by strsep(). |
| |
| Fixes: 027bd6cafd9a ("usb: core: Add "quirks" parameter for usbcore") |
| Signed-off-by: Kars Mulder <kerneldev@karsmulder.nl> |
| |
| Link: https://lore.kernel.org/r/5ee2-5f048a00-21-618c5c00@230659773 |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/usb/core/quirks.c | 16 ++++++++++++---- |
| 1 file changed, 12 insertions(+), 4 deletions(-) |
| |
| diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c |
| index e0b77674869ce..c96c50faccf72 100644 |
| --- a/drivers/usb/core/quirks.c |
| +++ b/drivers/usb/core/quirks.c |
| @@ -25,17 +25,23 @@ static unsigned int quirk_count; |
| |
| static char quirks_param[128]; |
| |
| -static int quirks_param_set(const char *val, const struct kernel_param *kp) |
| +static int quirks_param_set(const char *value, const struct kernel_param *kp) |
| { |
| - char *p, *field; |
| + char *val, *p, *field; |
| u16 vid, pid; |
| u32 flags; |
| size_t i; |
| int err; |
| |
| + val = kstrdup(value, GFP_KERNEL); |
| + if (!val) |
| + return -ENOMEM; |
| + |
| err = param_set_copystring(val, kp); |
| - if (err) |
| + if (err) { |
| + kfree(val); |
| return err; |
| + } |
| |
| mutex_lock(&quirk_mutex); |
| |
| @@ -60,10 +66,11 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp) |
| if (!quirk_list) { |
| quirk_count = 0; |
| mutex_unlock(&quirk_mutex); |
| + kfree(val); |
| return -ENOMEM; |
| } |
| |
| - for (i = 0, p = (char *)val; p && *p;) { |
| + for (i = 0, p = val; p && *p;) { |
| /* Each entry consists of VID:PID:flags */ |
| field = strsep(&p, ":"); |
| if (!field) |
| @@ -144,6 +151,7 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp) |
| |
| unlock: |
| mutex_unlock(&quirk_mutex); |
| + kfree(val); |
| |
| return 0; |
| } |
| -- |
| 2.25.1 |
| |