| From d2ffed5185df9d8d9ccd150e4340e3b6f96a8381 Mon Sep 17 00:00:00 2001 |
| From: Geert Uytterhoeven <geert+renesas@glider.be> |
| Date: Tue, 10 Apr 2018 15:21:45 +0200 |
| Subject: ARM: amba: Don't read past the end of sysfs "driver_override" buffer |
| |
| From: Geert Uytterhoeven <geert+renesas@glider.be> |
| |
| commit d2ffed5185df9d8d9ccd150e4340e3b6f96a8381 upstream. |
| |
| When printing the driver_override parameter when it is 4095 and 4094 |
| bytes long, the printing code would access invalid memory because we |
| need count + 1 bytes for printing. |
| |
| Cfr. commits 4efe874aace57dba ("PCI: Don't read past the end of sysfs |
| "driver_override" buffer") and bf563b01c2895a4b ("driver core: platform: |
| Don't read past the end of "driver_override" buffer"). |
| |
| Fixes: 3cf385713460eb2b ("ARM: 8256/1: driver coamba: add device binding path 'driver_override'") |
| Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> |
| Reviewed-by: Todd Kjos <tkjos@google.com> |
| Cc: stable <stable@vger.kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/amba/bus.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/amba/bus.c |
| +++ b/drivers/amba/bus.c |
| @@ -83,7 +83,8 @@ static ssize_t driver_override_store(str |
| struct amba_device *dev = to_amba_device(_dev); |
| char *driver_override, *old, *cp; |
| |
| - if (count > PATH_MAX) |
| + /* We need to keep extra room for a newline */ |
| + if (count >= (PAGE_SIZE - 1)) |
| return -EINVAL; |
| |
| driver_override = kstrndup(buf, count, GFP_KERNEL); |