From 6c091558d74b19dbd1888aed9338b4d0fd3396da Mon Sep 17 00:00:00 2001 From: Suraj Sonawane Date: Wed, 13 Nov 2024 17:35:32 +0530 Subject: [PATCH] [PATCH v4] KASAN: vmalloc-out-of-bounds Read in acpi_nfit_ctl(2) syz test Signed-off-by: Suraj Sonawane --- drivers/acpi/nfit/core.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 5429ec9ef..eb5349606 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -439,7 +439,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, { struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc); struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm); - union acpi_object in_obj, in_buf, *out_obj; + union acpi_object in_obj, in_buf, *out_obj = NULL; const struct nd_cmd_desc *desc = NULL; struct device *dev = acpi_desc->dev; struct nd_cmd_pkg *call_pkg = NULL; @@ -454,8 +454,14 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, if (cmd_rc) *cmd_rc = -EINVAL; - if (cmd == ND_CMD_CALL) - call_pkg = buf; + if (cmd == ND_CMD_CALL) { + if (!buf || buf_len < sizeof(*call_pkg)) { + rc = -EINVAL; + goto out; + } + call_pkg = (struct nd_cmd_pkg *)buf; + } + func = cmd_to_func(nfit_mem, cmd, call_pkg, &family); if (func < 0) return func; -- 2.34.1