Commit 1f1cc456 authored by Lars-Peter Clausen's avatar Lars-Peter Clausen Committed by Linus Walleij

gpio: GPIO_GET_CHIPINFO_IOCTL: Fix line offset validation

The current line offset validation is off by one. Depending on the data
stored behind the descs array this can either cause undefined behavior or
disclose arbitrary, potentially sensitive, memory to the issuing userspace
application.

Make sure that offset is within the bounds of the desc array.

Cc: stable@vger.kernel.org
Fixes: 521a2ad6 ("gpio: add userspace ABI for GPIO line information")
Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
parent 67bf5156
...@@ -839,7 +839,7 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) ...@@ -839,7 +839,7 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
if (copy_from_user(&lineinfo, ip, sizeof(lineinfo))) if (copy_from_user(&lineinfo, ip, sizeof(lineinfo)))
return -EFAULT; return -EFAULT;
if (lineinfo.line_offset > gdev->ngpio) if (lineinfo.line_offset >= gdev->ngpio)
return -EINVAL; return -EINVAL;
desc = &gdev->descs[lineinfo.line_offset]; desc = &gdev->descs[lineinfo.line_offset];
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment