linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Nick Crews <ncrews@chromium.org>
To: bleung@chromium.org, enric.balletbo@collabora.com
Cc: linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org,
	dan.carpenter@oracle.com, dlaurie@chromium.org,
	ncrews@chromium.org
Subject: [PATCH -next] platform/chrome: Fix off-by-one error in wilco_ec/debugfs.c
Date: Wed, 20 Feb 2019 14:58:27 -0700	[thread overview]
Message-ID: <20190220215826.44366-1-ncrews@chromium.org> (raw)

Before, in debugfs.c it was possible to supply only the message type,
and not supply any other arguments when sending raw commands. However,
this is never used by the EC, and it led to an underflow error. Now,
just don't allow too short of a command, we will never need
that anyways.

Fixes: 46c7fd06f8c9 ("platform/chrome: wilco_ec: Add support for raw commands in debugfs")
Signed-off-by: Nick Crews <ncrews@chromium.org>
---
 drivers/platform/chrome/wilco_ec/debugfs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/chrome/wilco_ec/debugfs.c b/drivers/platform/chrome/wilco_ec/debugfs.c
index 46ff3b6c46c7..c090db2cd5be 100644
--- a/drivers/platform/chrome/wilco_ec/debugfs.c
+++ b/drivers/platform/chrome/wilco_ec/debugfs.c
@@ -136,8 +136,8 @@ static ssize_t raw_write(struct file *file, const char __user *user_buf,
 	ret = parse_hex_sentence(buf, kcount, request_data, TYPE_AND_DATA_SIZE);
 	if (ret < 0)
 		return ret;
-	/* Need at least two bytes for message type */
-	if (ret < 2)
+	/* Need at least two bytes for message type and one for command */
+	if (ret < 3)
 		return -EINVAL;
 
 	/* Clear response data buffer */
@@ -145,7 +145,7 @@ static ssize_t raw_write(struct file *file, const char __user *user_buf,
 
 	msg.type = request_data[0] << 8 | request_data[1];
 	msg.flags = WILCO_EC_FLAG_RAW;
-	msg.command = ret > 2 ? request_data[2] : 0;
+	msg.command = request_data[2];
 	msg.request_data = ret > 3 ? request_data + 3 : 0;
 	msg.request_size = ret - 3;
 	msg.response_data = debug_info->raw_data;

             reply	other threads:[~2019-02-20 22:01 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-02-20 21:58 Nick Crews [this message]
2019-02-20 22:06 ` [PATCH -next] platform/chrome: Fix off-by-one error in wilco_ec/debugfs.c Enric Balletbo i Serra
2019-02-20 22:15   ` Nick Crews
2019-02-21  7:58     ` Enric Balletbo i Serra
2019-02-21 18:31     ` Dan Carpenter
2019-02-21 19:09       ` Nick Crews

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190220215826.44366-1-ncrews@chromium.org \
    --to=ncrews@chromium.org \
    --cc=bleung@chromium.org \
    --cc=dan.carpenter@oracle.com \
    --cc=dlaurie@chromium.org \
    --cc=enric.balletbo@collabora.com \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).