diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2016-06-21 16:58:46 +0300 |
|---|---|---|
| committer | Olof Johansson <olof@lixom.net> | 2016-07-05 14:01:52 -0700 |
| commit | 096cdc6f52225835ff503f987a0d68ef770bb78e (patch) | |
| tree | 7e123fe975c5578ff97ad21811f9e4500210fb0c | |
| parent | 33688abb2802ff3a230bd2441f765477b94cc89e (diff) | |
platform/chrome: cros_ec_dev - double fetch bug in ioctl
We verify "u_cmd.outsize" and "u_cmd.insize" but we need to make sure
that those values have not changed between the two copy_from_user()
calls. Otherwise it could lead to a buffer overflow.
Additionally, cros_ec_cmd_xfer() can set s_cmd->insize to a lower value.
We should use the new smaller value so we don't copy too much data to
the user.
Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
Fixes: a841178445bb ('mfd: cros_ec: Use a zero-length array for command data')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Gwendal Grignou <gwendal@chromium.org>
Cc: <stable@vger.kernel.org> # v4.2+
Signed-off-by: Olof Johansson <olof@lixom.net>