linux-kernel - [PATCH] eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <YsUyqwe9Caxb6k4g@kili>
Date:   Wed, 6 Jul 2022 09:58:51 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Arnd Bergmann <arnd@...db.de>,
        Serge Semin <fancer.lancer@...il.com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: [PATCH] eeprom: idt_89hpesx: uninitialized data in
 idt_dbgfs_csr_write()

The simple_write_to_buffer() here is used to copy a string from the
user.  However the function call will succeed if it manages to read
just one byte anywhere within the buffer while we need the whole string
to be initialized to avoid using uninitialized data.

Fixes: cfad6425382e ("eeprom: Add IDT 89HPESx EEPROM/CSR driver")
Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
---
 drivers/misc/eeprom/idt_89hpesx.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c
index b0cff4b152da..30e146b32205 100644
--- a/drivers/misc/eeprom/idt_89hpesx.c
+++ b/drivers/misc/eeprom/idt_89hpesx.c
@@ -909,15 +909,13 @@ static ssize_t idt_dbgfs_csr_write(struct file *filep, const char __user *ubuf,
 	u32 csraddr, csrval;
 	char *buf;
 
-	/* Copy data from User-space */
-	buf = kmalloc(count + 1, GFP_KERNEL);
-	if (!buf)
-		return -ENOMEM;
+	if (*offp != 0)
+		return -EINVAL;
 
-	ret = simple_write_to_buffer(buf, count, offp, ubuf, count);
-	if (ret < 0)
-		goto free_buf;
-	buf[count] = 0;
+	/* Copy data from User-space */
+	buf = strndup_user(ubuf, count + 1);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
 
 	/* Find position of colon in the buffer */
 	colon_ch = strnchr(buf, count, ':');
-- 
2.35.1