From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Christian Gromm <christian.gromm@microchip.com>,
Dan Carpenter <dan.carpenter@oracle.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>,
devel@driverdev.osuosl.org
Subject: [PATCH AUTOSEL 4.14 09/16] staging: most: sound: add sanity check for function argument
Date: Wed, 24 Feb 2021 07:55:06 -0500 [thread overview]
Message-ID: <20210224125514.483935-9-sashal@kernel.org> (raw)
In-Reply-To: <20210224125514.483935-1-sashal@kernel.org>
From: Christian Gromm <christian.gromm@microchip.com>
[ Upstream commit 45b754ae5b82949dca2b6e74fa680313cefdc813 ]
This patch checks the function parameter 'bytes' before doing the
subtraction to prevent memory corruption.
Signed-off-by: Christian Gromm <christian.gromm@microchip.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/1612282865-21846-1-git-send-email-christian.gromm@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/most/aim-sound/sound.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/staging/most/aim-sound/sound.c b/drivers/staging/most/aim-sound/sound.c
index ea1366a440083..e259bf4956ab6 100644
--- a/drivers/staging/most/aim-sound/sound.c
+++ b/drivers/staging/most/aim-sound/sound.c
@@ -92,6 +92,8 @@ static void swap_copy24(u8 *dest, const u8 *source, unsigned int bytes)
{
unsigned int i = 0;
+ if (bytes < 2)
+ return;
while (i < bytes - 2) {
dest[i] = source[i + 2];
dest[i + 1] = source[i + 1];
--
2.27.0
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
Christian Gromm <christian.gromm@microchip.com>,
devel@driverdev.osuosl.org,
Dan Carpenter <dan.carpenter@oracle.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: [PATCH AUTOSEL 4.14 09/16] staging: most: sound: add sanity check for function argument
Date: Wed, 24 Feb 2021 07:55:06 -0500 [thread overview]
Message-ID: <20210224125514.483935-9-sashal@kernel.org> (raw)
In-Reply-To: <20210224125514.483935-1-sashal@kernel.org>
From: Christian Gromm <christian.gromm@microchip.com>
[ Upstream commit 45b754ae5b82949dca2b6e74fa680313cefdc813 ]
This patch checks the function parameter 'bytes' before doing the
subtraction to prevent memory corruption.
Signed-off-by: Christian Gromm <christian.gromm@microchip.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/1612282865-21846-1-git-send-email-christian.gromm@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/most/aim-sound/sound.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/staging/most/aim-sound/sound.c b/drivers/staging/most/aim-sound/sound.c
index ea1366a440083..e259bf4956ab6 100644
--- a/drivers/staging/most/aim-sound/sound.c
+++ b/drivers/staging/most/aim-sound/sound.c
@@ -92,6 +92,8 @@ static void swap_copy24(u8 *dest, const u8 *source, unsigned int bytes)
{
unsigned int i = 0;
+ if (bytes < 2)
+ return;
while (i < bytes - 2) {
dest[i] = source[i + 2];
dest[i + 1] = source[i + 1];
--
2.27.0
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
next prev parent reply other threads:[~2021-02-24 14:17 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-24 12:54 [PATCH AUTOSEL 4.14 01/16] staging: fwserial: Fix error handling in fwserial_create Sasha Levin
2021-02-24 12:54 ` Sasha Levin
2021-02-24 12:54 ` [PATCH AUTOSEL 4.14 02/16] x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 03/16] vt/consolemap: do font sum unsigned Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 04/16] wlcore: Fix command execute failure 19 for wl12xx Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 05/16] pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 06/16] ath10k: fix wmi mgmt tx queue full due to race condition Sasha Levin
2021-02-24 12:55 ` Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 07/16] x86/build: Treat R_386_PLT32 relocation as R_386_PC32 Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 08/16] Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data Sasha Levin
2021-02-24 12:55 ` Sasha Levin [this message]
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 09/16] staging: most: sound: add sanity check for function argument Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 10/16] media: mceusb: sanity check for prescaler value Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 11/16] media: uvcvideo: Allow entities with no pads Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 12/16] f2fs: handle unallocated section and zone on pinned/atgc Sasha Levin
2021-02-24 12:55 ` [f2fs-dev] " Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 13/16] tomoyo: ignore data race while checking quota Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 14/16] smackfs: restrict bytes count in smackfs write functions Sasha Levin
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 15/16] Drivers: hv: vmbus: Resolve race condition in vmbus_onoffer_rescind() Sasha Levin
2021-02-24 13:22 ` Andrea Parri
2021-02-24 12:55 ` [PATCH AUTOSEL 4.14 16/16] parisc: Bump 64-bit IRQ stack size to 64 KB Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210224125514.483935-9-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=christian.gromm@microchip.com \
--cc=dan.carpenter@oracle.com \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.