| From b4f7640b1ea92f96f8e80dba451fa6db2cabe788 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Tue, 16 Jul 2019 16:30:03 -0700 |
| Subject: drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings |
| |
| [ Upstream commit 156e0b1a8112b76e351684ac948c59757037ac36 ] |
| |
| The dev_info.name[] array has space for RIO_MAX_DEVNAME_SZ + 1 |
| characters. But the problem here is that we don't ensure that the user |
| put a NUL terminator on the end of the string. It could lead to an out |
| of bounds read. |
| |
| Link: http://lkml.kernel.org/r/20190529110601.GB19119@mwanda |
| Fixes: e8de370188d0 ("rapidio: add mport char device driver") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Acked-by: Alexandre Bounine <alex.bou9@gmail.com> |
| Cc: Ira Weiny <ira.weiny@intel.com> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/rapidio/devices/rio_mport_cdev.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c |
| index f32fc704cb7ed..28c45db45abad 100644 |
| --- a/drivers/rapidio/devices/rio_mport_cdev.c |
| +++ b/drivers/rapidio/devices/rio_mport_cdev.c |
| @@ -1743,6 +1743,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv, |
| |
| if (copy_from_user(&dev_info, arg, sizeof(dev_info))) |
| return -EFAULT; |
| + dev_info.name[sizeof(dev_info.name) - 1] = '\0'; |
| |
| rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name, |
| dev_info.comptag, dev_info.destid, dev_info.hopcount); |
| @@ -1874,6 +1875,7 @@ static int rio_mport_del_riodev(struct mport_cdev_priv *priv, void __user *arg) |
| |
| if (copy_from_user(&dev_info, arg, sizeof(dev_info))) |
| return -EFAULT; |
| + dev_info.name[sizeof(dev_info.name) - 1] = '\0'; |
| |
| mport = priv->md->mport; |
| |
| -- |
| 2.20.1 |
| |