linux-kernel - Re: [PATCH -next] platform/chrome: Fix off-by-one error in wilco

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a0cf4649-e06f-aded-55ad-893560c2414a@collabora.com>
Date:   Wed, 20 Feb 2019 23:06:51 +0100
From:   Enric Balletbo i Serra <enric.balletbo@...labora.com>
To:     Nick Crews <ncrews@...omium.org>, bleung@...omium.org
Cc:     linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org,
        dan.carpenter@...cle.com, dlaurie@...omium.org
Subject: Re: [PATCH -next] platform/chrome: Fix off-by-one error in
 wilco_ec/debugfs.c

Hi Nick,

Thanks for the patch.

On 20/2/19 22:58, Nick Crews wrote:
> Before, in debugfs.c it was possible to supply only the message type,
> and not supply any other arguments when sending raw commands. However,
> this is never used by the EC, and it led to an underflow error. Now,
> just don't allow too short of a command, we will never need
> that anyways.
> 
> Fixes: 46c7fd06f8c9 ("platform/chrome: wilco_ec: Add support for raw commands in debugfs")

As this is -next material I'd like to squash the fix if you don't mind.

-- Enric

> Signed-off-by: Nick Crews <ncrews@...omium.org>
> ---
>  drivers/platform/chrome/wilco_ec/debugfs.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/platform/chrome/wilco_ec/debugfs.c b/drivers/platform/chrome/wilco_ec/debugfs.c
> index 46ff3b6c46c7..c090db2cd5be 100644
> --- a/drivers/platform/chrome/wilco_ec/debugfs.c
> +++ b/drivers/platform/chrome/wilco_ec/debugfs.c
> @@ -136,8 +136,8 @@ static ssize_t raw_write(struct file *file, const char __user *user_buf,
>  	ret = parse_hex_sentence(buf, kcount, request_data, TYPE_AND_DATA_SIZE);
>  	if (ret < 0)
>  		return ret;
> -	/* Need at least two bytes for message type */
> -	if (ret < 2)
> +	/* Need at least two bytes for message type and one for command */
> +	if (ret < 3)
>  		return -EINVAL;
>  
>  	/* Clear response data buffer */
> @@ -145,7 +145,7 @@ static ssize_t raw_write(struct file *file, const char __user *user_buf,
>  
>  	msg.type = request_data[0] << 8 | request_data[1];
>  	msg.flags = WILCO_EC_FLAG_RAW;
> -	msg.command = ret > 2 ? request_data[2] : 0;
> +	msg.command = request_data[2];
>  	msg.request_data = ret > 3 ? request_data + 3 : 0;
>  	msg.request_size = ret - 3;
>  	msg.response_data = debug_info->raw_data;
>