linux-kernel - [PATCH 1/1] platform/chrome: check *dest of memcpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 17 May 2022 17:55:21 +0800
From:   Yuanjun Gong <ruc_gongyuanjun@....com>
To:     Yuanjun Gong <ruc_gongyuanjun@....com>,
        Benson Leung <bleung@...omium.org>,
        chrome-platform@...ts.linux.dev, linux-kernel@...r.kernel.org
Cc:     stable@...r.kernel.org
Subject: [PATCH 1/1] platform/chrome: check *dest of memcpy

From: Gong Yuanjun <ruc_gongyuanjun@....com>

In regulator/cros-ec-regulator.c, cros_ec_cmd is sometimes called
with *indata set to NULL.

static int cros_ec_regulator_enable(struct regulator_dev *dev){
...
     cros_ec_cmd(data->ec_dev, 0, EC_CMD_REGULATOR_ENABLE, &cmd,
			  sizeof(cmd), NULL, 0)
...}

Don't do memcpy if indata is NULL.

Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@....com>
---
 drivers/platform/chrome/cros_ec_proto.c | 2 +-
 drivers/regulator/cros-ec-regulator.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
index c4caf2e2de82..da175c57cff7 100644
--- a/drivers/platform/chrome/cros_ec_proto.c
+++ b/drivers/platform/chrome/cros_ec_proto.c
@@ -938,7 +938,7 @@ int cros_ec_command(struct cros_ec_device *ec_dev,
 	if (ret < 0)
 		goto error;
 
-	if (insize)
+	if (indata && insize)
 		memcpy(indata, msg->data, insize);
 error:
 	kfree(msg);
diff --git a/drivers/regulator/cros-ec-regulator.c b/drivers/regulator/cros-ec-regulator.c
index c4754f3cf233..1c7ff085e492 100644
--- a/drivers/regulator/cros-ec-regulator.c
+++ b/drivers/regulator/cros-ec-regulator.c
@@ -44,7 +44,7 @@ static int cros_ec_cmd(struct cros_ec_device *ec, u32 version, u32 command,
 	if (ret < 0)
 		goto cleanup;
 
-	if (insize)
+	if (indata && insize)
 		memcpy(indata, msg->data, insize);
 
 cleanup:
-- 
2.17.1