redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

gpio: GPIO_GET_CHIPINFO_IOCTL: Fix line offset validation 

The current line offset validation is off by one. Depending on the data
stored behind the descs array this can either cause undefined behavior or
disclose arbitrary, potentially sensitive, memory to the issuing userspace
application.

Make sure that offset is within the bounds of the desc array.

Cc: stable@vger.kernel.org
Fixes: 521a2ad6f8 ("gpio: add userspace ABI for GPIO line information")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
hifive-unleashed-5.1
Lars-Peter Clausen 2016-10-18 16:53:59 +02:00 committed by Linus Walleij
parent 67bf5156ed
commit 1f1cc4566b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpio/gpiolib.c
View File

@ -839,7 +839,7 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
if (copy_from_user(&lineinfo, ip, sizeof(lineinfo)))
return -EFAULT;
if (lineinfo.line_offset > gdev->ngpio)
if (lineinfo.line_offset >= gdev->ngpio)
return -EINVAL;
desc = &gdev->descs[lineinfo.line_offset];