All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] remoteproc: avoid array index out of bounds in debugfs file
@ 2022-03-28 12:34 ` Xiaobing shi
  0 siblings, 0 replies; 6+ messages in thread
From: Xiaobing shi @ 2022-03-28 12:34 UTC (permalink / raw)
  To: Bjorn Andersson, Mathieu Poirier
  Cc: Matthias Brugger, linux-remoteproc, linux-kernel,
	linux-arm-kernel, linux-mediatek, Xiaobing shi

There is a negative offset of an on-stack array that causes an out of
bounds issue when someone called with a zero 'count' argument to
syswrite().

	buf[count - 1]

We should add an extra check in rproc_coredump_write() to prevent the
access.

Signed-off-by: Xiaobing shi <xiaobing.shi@mediatek.com>
---
 drivers/remoteproc/remoteproc_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/remoteproc/remoteproc_debugfs.c b/drivers/remoteproc/remoteproc_debugfs.c
index b5a1e3b697d9..581930483ef8 100644
--- a/drivers/remoteproc/remoteproc_debugfs.c
+++ b/drivers/remoteproc/remoteproc_debugfs.c
@@ -76,7 +76,7 @@ static ssize_t rproc_coredump_write(struct file *filp,
 	int ret, err = 0;
 	char buf[20];
 
-	if (count > sizeof(buf))
+	if (count < 1 || count > sizeof(buf))
 		return -EINVAL;
 
 	ret = copy_from_user(buf, user_buf, count);
-- 
2.18.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH] remoteproc: avoid array index out of bounds in debugfs file
@ 2022-03-28 12:34 ` Xiaobing shi
  0 siblings, 0 replies; 6+ messages in thread
From: Xiaobing shi @ 2022-03-28 12:34 UTC (permalink / raw)
  To: Bjorn Andersson, Mathieu Poirier
  Cc: Matthias Brugger, linux-remoteproc, linux-kernel,
	linux-arm-kernel, linux-mediatek, Xiaobing shi

There is a negative offset of an on-stack array that causes an out of
bounds issue when someone called with a zero 'count' argument to
syswrite().

	buf[count - 1]

We should add an extra check in rproc_coredump_write() to prevent the
access.

Signed-off-by: Xiaobing shi <xiaobing.shi@mediatek.com>
---
 drivers/remoteproc/remoteproc_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/remoteproc/remoteproc_debugfs.c b/drivers/remoteproc/remoteproc_debugfs.c
index b5a1e3b697d9..581930483ef8 100644
--- a/drivers/remoteproc/remoteproc_debugfs.c
+++ b/drivers/remoteproc/remoteproc_debugfs.c
@@ -76,7 +76,7 @@ static ssize_t rproc_coredump_write(struct file *filp,
 	int ret, err = 0;
 	char buf[20];
 
-	if (count > sizeof(buf))
+	if (count < 1 || count > sizeof(buf))
 		return -EINVAL;
 
 	ret = copy_from_user(buf, user_buf, count);
-- 
2.18.0


_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH] remoteproc: avoid array index out of bounds in debugfs file
@ 2022-03-28 12:34 ` Xiaobing shi
  0 siblings, 0 replies; 6+ messages in thread
From: Xiaobing shi @ 2022-03-28 12:34 UTC (permalink / raw)
  To: Bjorn Andersson, Mathieu Poirier
  Cc: Matthias Brugger, linux-remoteproc, linux-kernel,
	linux-arm-kernel, linux-mediatek, Xiaobing shi

There is a negative offset of an on-stack array that causes an out of
bounds issue when someone called with a zero 'count' argument to
syswrite().

	buf[count - 1]

We should add an extra check in rproc_coredump_write() to prevent the
access.

Signed-off-by: Xiaobing shi <xiaobing.shi@mediatek.com>
---
 drivers/remoteproc/remoteproc_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/remoteproc/remoteproc_debugfs.c b/drivers/remoteproc/remoteproc_debugfs.c
index b5a1e3b697d9..581930483ef8 100644
--- a/drivers/remoteproc/remoteproc_debugfs.c
+++ b/drivers/remoteproc/remoteproc_debugfs.c
@@ -76,7 +76,7 @@ static ssize_t rproc_coredump_write(struct file *filp,
 	int ret, err = 0;
 	char buf[20];
 
-	if (count > sizeof(buf))
+	if (count < 1 || count > sizeof(buf))
 		return -EINVAL;
 
 	ret = copy_from_user(buf, user_buf, count);
-- 
2.18.0


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH] remoteproc: avoid array index out of bounds in debugfs file
  2022-03-28 12:34 ` Xiaobing shi
  (?)
@ 2022-03-29  2:46   ` Miles Chen
  -1 siblings, 0 replies; 6+ messages in thread
From: Miles Chen @ 2022-03-29  2:46 UTC (permalink / raw)
  To: xiaobing.shi
  Cc: bjorn.andersson, linux-arm-kernel, linux-kernel, linux-mediatek,
	linux-remoteproc, mathieu.poirier, matthias.bgg

Hi Xiaobing,

> There is a negative offset of an on-stack array that causes an out of
> bounds issue when someone called with a zero 'count' argument to
> syswrite().
> 
> 	buf[count - 1]
> 
> We should add an extra check in rproc_coredump_write() to prevent the
> access.
> 
> Signed-off-by: Xiaobing shi <xiaobing.shi@mediatek.com>

Thanks for the patch.
However, Alistair has fixed this issue:
https://lore.kernel.org/all/20220119232139.1125908-1-adelva@google.com/

Thanks,
Miles

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] remoteproc: avoid array index out of bounds in debugfs file
@ 2022-03-29  2:46   ` Miles Chen
  0 siblings, 0 replies; 6+ messages in thread
From: Miles Chen @ 2022-03-29  2:46 UTC (permalink / raw)
  To: xiaobing.shi
  Cc: bjorn.andersson, linux-arm-kernel, linux-kernel, linux-mediatek,
	linux-remoteproc, mathieu.poirier, matthias.bgg

Hi Xiaobing,

> There is a negative offset of an on-stack array that causes an out of
> bounds issue when someone called with a zero 'count' argument to
> syswrite().
> 
> 	buf[count - 1]
> 
> We should add an extra check in rproc_coredump_write() to prevent the
> access.
> 
> Signed-off-by: Xiaobing shi <xiaobing.shi@mediatek.com>

Thanks for the patch.
However, Alistair has fixed this issue:
https://lore.kernel.org/all/20220119232139.1125908-1-adelva@google.com/

Thanks,
Miles

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] remoteproc: avoid array index out of bounds in debugfs file
@ 2022-03-29  2:46   ` Miles Chen
  0 siblings, 0 replies; 6+ messages in thread
From: Miles Chen @ 2022-03-29  2:46 UTC (permalink / raw)
  To: xiaobing.shi
  Cc: bjorn.andersson, linux-arm-kernel, linux-kernel, linux-mediatek,
	linux-remoteproc, mathieu.poirier, matthias.bgg

Hi Xiaobing,

> There is a negative offset of an on-stack array that causes an out of
> bounds issue when someone called with a zero 'count' argument to
> syswrite().
> 
> 	buf[count - 1]
> 
> We should add an extra check in rproc_coredump_write() to prevent the
> access.
> 
> Signed-off-by: Xiaobing shi <xiaobing.shi@mediatek.com>

Thanks for the patch.
However, Alistair has fixed this issue:
https://lore.kernel.org/all/20220119232139.1125908-1-adelva@google.com/

Thanks,
Miles

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-03-29  2:57 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-28 12:34 [PATCH] remoteproc: avoid array index out of bounds in debugfs file Xiaobing shi
2022-03-28 12:34 ` Xiaobing shi
2022-03-28 12:34 ` Xiaobing shi
2022-03-29  2:46 ` Miles Chen
2022-03-29  2:46   ` Miles Chen
2022-03-29  2:46   ` Miles Chen

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.