linux-kernel - Re: [patch] max17042_battery: fix a couple buffer overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 15 Mar 2012 10:20:34 -0700
From:	Dirk Brandewie <dirk.brandewie@...il.com>
To:	Dan Carpenter <dan.carpenter@...cle.com>
CC:	Grant Likely <grant.likely@...retlab.ca>,
	Dirk Brandewie <dirk.brandewie@...il.com>,
	Rob Herring <rob.herring@...xeda.com>,
	Anton Vorontsov <anton.vorontsov@...aro.org>,
	MyungJoo Ham <myungjoo.ham@...sung.com>,
	Kyungmin Park <kyungmin.park@...sung.com>,
	Philip Rakity <prakity@...vell.com>,
	linux-kernel@...r.kernel.org, devicetree-discuss@...ts.ozlabs.org,
	kernel-janitors@...r.kernel.org
Subject: Re: [patch] max17042_battery: fix a couple buffer overflows

On 03/15/2012 04:37 AM, Dan Carpenter wrote:
> There are a couple issues here caused by confusion between sizeof()
> and ARRAY_SIZE().  "table_size" should be the number of elements, but we
> should allocate it with kcalloc() so that we allocate the correct number
> of bytes.
>
> In max17042_init_model() we don't allocate enough space so we go past
> the end of the array in max17042_read_model_data() and
> max17042_model_data_compare().
>
> In max17042_verify_model_lock() we allocate the right amount of space
> but we call max17042_read_model_data() with the wrong number of elements
> and also in the for loop we go past the end of the array.
>
> Signed-off-by: Dan Carpenter<dan.carpenter@...cle.com>
Acked-by: Dirk Brandewie <dirk.brandewie@...il.com>

Typo in first ack :-(
> ---
> I don't have this hardware.  The original code is clearly buggy, but I
> can't test that my fix is correct.  Please review carefully.
>
> diff --git a/drivers/power/max17042_battery.c b/drivers/power/max17042_battery.c
> index e36763a..f8cd48c 100644
> --- a/drivers/power/max17042_battery.c
> +++ b/drivers/power/max17042_battery.c
> @@ -328,11 +328,10 @@ static inline int max17042_model_data_compare(struct max17042_chip *chip,
>   static int max17042_init_model(struct max17042_chip *chip)
>   {
>   	int ret;
> -	int table_size =
> -		sizeof(chip->pdata->config_data->cell_char_tbl)/sizeof(u16);
> +	int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
>   	u16 *temp_data;
>
> -	temp_data = kzalloc(table_size, GFP_KERNEL);
> +	temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
>   	if (!temp_data)
>   		return -ENOMEM;
>
> @@ -357,12 +356,11 @@ static int max17042_init_model(struct max17042_chip *chip)
>   static int max17042_verify_model_lock(struct max17042_chip *chip)
>   {
>   	int i;
> -	int table_size =
> -		sizeof(chip->pdata->config_data->cell_char_tbl);
> +	int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
>   	u16 *temp_data;
>   	int ret = 0;
>
> -	temp_data = kzalloc(table_size, GFP_KERNEL);
> +	temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
>   	if (!temp_data)
>   		return -ENOMEM;
>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/