Commit 7118be7c authored by Markus Burri's avatar Markus Burri Committed by Bartosz Golaszewski
Browse files

gpio: virtuser: fix potential out-of-bound write 



If the caller wrote more characters, count is truncated to the max
available space in "simple_write_to_buffer". Check that the input
size does not exceed the buffer size. Write a zero termination
afterwards.

Reported-by: default avatarkernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202505091754.285hHbr2-lkp@intel.com/


Signed-off-by: default avatarMarkus Burri <markus.burri@mt.com>
Link: https://lore.kernel.org/r/20250509150459.115489-1-markus.burri@mt.com


Signed-off-by: default avatarBartosz Golaszewski <bartosz.golaszewski@linaro.org>
parent 3e38f946

drivers/gpio/gpio-virtuser.c

+10 −2
Original line number Diff line number Diff line
@@ -401,10 +401,15 @@ static ssize_t gpio_virtuser_direction_do_write(struct file *file, 
	char buf[32], *trimmed;

	int ret, dir, val = 0;



	ret = simple_write_to_buffer(buf, sizeof(buf), ppos, user_buf, count);

	if (count >= sizeof(buf))

		return -EINVAL;



	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);

	if (ret < 0)

		return ret;



	buf[ret] = '\0';



	trimmed = strim(buf);



	if (strcmp(trimmed, "input") == 0) {
@@ -623,12 +628,15 @@ static ssize_t gpio_virtuser_consumer_write(struct file *file, 
	char buf[GPIO_VIRTUSER_NAME_BUF_LEN + 2];

	int ret;



	if (count >= sizeof(buf))

		return -EINVAL;



	ret = simple_write_to_buffer(buf, GPIO_VIRTUSER_NAME_BUF_LEN, ppos,

				     user_buf, count);

	if (ret < 0)

		return ret;



	buf[strlen(buf) - 1] = '\0';

	buf[ret] = '\0';



	ret = gpiod_set_consumer_name(data->ad.desc, buf);

	if (ret)