linux-kernel - [PATCH 2/8] mfd: cros_ec: Sanity check in and out sizes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1426179768-27482-3-git-send-email-javier.martinez@collabora.co.uk>
Date:	Thu, 12 Mar 2015 18:02:42 +0100
From:	Javier Martinez Canillas <javier.martinez@...labora.co.uk>
To:	Olof Johansson <olof@...om.net>
Cc:	Lee Jones <lee.jones@...aro.org>,
	Doug Anderson <dianders@...omium.org>,
	Bill Richardson <wfrichar@...omium.org>,
	Simon Glass <sjg@...gle.com>,
	Gwendal Grignou <gwendal@...gle.com>,
	Stephen Barber <smbarber@...omium.org>,
	Todd Broch <tbroch@...omium.org>,
	linux-samsung-soc@...r.kernel.org, linux-kernel@...r.kernel.org,
	Javier Martinez Canillas <javier.martinez@...labora.co.uk>
Subject: [PATCH 2/8] mfd: cros_ec: Sanity check in and out sizes

The cros_ec_cmd_xfer() function is used to communicate with the EC
and callers set the sizes of data in the input and output buffers.

But these sizes need to be checked to ensure that don't exceed the
fixed maximum length of the input and output buffers.

Reported-by : Dan Carpenter <dan.carpenter@...cle.com>
Signed-off-by: Javier Martinez Canillas <javier.martinez@...labora.co.uk>
---
 drivers/mfd/cros_ec.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
index c4aecc6f8373..07c53c27c82a 100644
--- a/drivers/mfd/cros_ec.c
+++ b/drivers/mfd/cros_ec.c
@@ -70,6 +70,20 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
 {
 	int ret;
 
+	if (msg->insize > ARRAY_SIZE(msg->indata)) {
+		dev_err(ec_dev->dev,
+			"response of size %u is too big (max: %u)\n",
+			msg->insize, ARRAY_SIZE(msg->indata));
+		return -EMSGSIZE;
+	}
+
+	if (msg->outsize > ARRAY_SIZE(msg->outdata)) {
+		dev_err(ec_dev->dev,
+			"request of size %u is too big (max: %u)\n",
+			msg->outsize, ARRAY_SIZE(msg->outdata));
+		return -EMSGSIZE;
+	}
+
 	mutex_lock(&ec_dev->lock);
 	ret = ec_dev->cmd_xfer(ec_dev, msg);
 	if (msg->result == EC_RES_IN_PROGRESS) {
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/