linux-kernel - [PATCH -next] xtensa/simdisk: fix error handling in proc_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 May 2022 16:05:33 +0800
From:   Yi Yang <yiyang13@...wei.com>
To:     <chris@...kel.net>, <jcmvbkbc@...il.com>, <viro@...iv.linux.org.uk>
CC:     <linux-xtensa@...ux-xtensa.org>, <linux-kernel@...r.kernel.org>,
        <axboe@...nel.dk>, <wangweiyang2@...wei.com>
Subject: [PATCH -next] xtensa/simdisk: fix error handling in proc_read_simdisk()

The frist simple_read_from_buffer() will change ppos. if ppos >= 1.
The second simple_read_from_buffer() will does not work and return 0.

Fixes: a69755b18774 ("xtensa simdisk: switch to proc_create_data()")
Signed-off-by: Yi Yang <yiyang13@...wei.com>
---
 arch/xtensa/platforms/iss/simdisk.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/arch/xtensa/platforms/iss/simdisk.c b/arch/xtensa/platforms/iss/simdisk.c
index 0f0e0724397f..618c080c388d 100644
--- a/arch/xtensa/platforms/iss/simdisk.c
+++ b/arch/xtensa/platforms/iss/simdisk.c
@@ -210,13 +210,21 @@ static ssize_t proc_read_simdisk(struct file *file, char __user *buf,
 {
 	struct simdisk *dev = pde_data(file_inode(file));
 	const char *s = dev->filename;
+	char *temp;
+
 	if (s) {
+		ssize_t len = strlen(s);
+
+		temp = kmalloc(len + 2, GFP_KERNEL);
+		if (!temp)
+			return -ENOMEM;
+
+		scnprintf(temp, len + 2, "%s\n", s);
 		ssize_t n = simple_read_from_buffer(buf, size, ppos,
-							s, strlen(s));
-		if (n < 0)
-			return n;
-		buf += n;
-		size -= n;
+							temp, strlen(temp));
+
+		kfree(temp);
+		return n;
 	}
 	return simple_read_from_buffer(buf, size, ppos, "\n", 1);
 }
-- 
2.17.1