Commit 88da5f4b authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge tag 'w1-drv-6.20' of... 

Merge tag 'w1-drv-6.20' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1 into char-misc-linus

1-Wire bus drivers fixes

Non critical (old issues) fixes:
1. Fix possible buffer overflow in W1 thermal driver sysfs interfasce,
2. Drop duplicated device put when attaching a slave device failed,
   which could lead to memory corruption.

* tag 'w1-drv-6.20' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1:
  w1: fix redundant counter decrement in w1_attach_slave_device()
  w1: therm: Fix off-by-one buffer overflow in alarms_store
parents e03b29b5 cc8f92e4

drivers/w1/slaves/w1_therm.c

+20 −42
Original line number Diff line number Diff line
@@ -1836,53 +1836,35 @@ static ssize_t alarms_store(struct device *device, 
	struct w1_slave *sl = dev_to_w1_slave(device);

	struct therm_info info;

	u8 new_config_register[3];	/* array of data to be written */

	int temp, ret;

	char *token = NULL;

	long long temp;

	int ret = 0;

	s8 tl, th;	/* 1 byte per value + temp ring order */

	char *p_args, *orig;



	p_args = orig = kmalloc(size, GFP_KERNEL);

	/* Safe string copys as buf is const */

	if (!p_args) {

		dev_warn(device,

			"%s: error unable to allocate memory %d\n",

			__func__, -ENOMEM);

		return size;

	}

	strcpy(p_args, buf);



	/* Split string using space char */

	token = strsep(&p_args, " ");



	if (!token)	{

		dev_info(device,

			"%s: error parsing args %d\n", __func__, -EINVAL);

		goto free_m;

	}



	/* Convert 1st entry to int */

	ret = kstrtoint (token, 10, &temp);

	const char *p = buf;

	char *endp;



	temp = simple_strtoll(p, &endp, 10);

	if (p == endp || *endp != ' ')

		ret = -EINVAL;

	else if (temp < INT_MIN || temp > INT_MAX)

		ret = -ERANGE;

	if (ret) {

		dev_info(device,

			"%s: error parsing args %d\n", __func__, ret);

		goto free_m;

		return size;

	}



	tl = int_to_short(temp);



	/* Split string using space char */

	token = strsep(&p_args, " ");

	if (!token)	{

		dev_info(device,

			"%s: error parsing args %d\n", __func__, -EINVAL);

		goto free_m;

	}

	/* Convert 2nd entry to int */

	ret = kstrtoint (token, 10, &temp);

	p = endp + 1;

	temp = simple_strtoll(p, &endp, 10);

	if (p == endp)

		ret = -EINVAL;

	else if (temp < INT_MIN || temp > INT_MAX)

		ret = -ERANGE;

	if (ret) {

		dev_info(device,

			"%s: error parsing args %d\n", __func__, ret);

		goto free_m;

		return size;

	}



	/* Prepare to cast to short by eliminating out of range values */
@@ -1905,7 +1887,7 @@ static ssize_t alarms_store(struct device *device, 
		dev_info(device,

			"%s: error reading from the slave device %d\n",

			__func__, ret);

		goto free_m;

		return size;

	}



	/* Write data in the device RAM */
@@ -1913,7 +1895,7 @@ static ssize_t alarms_store(struct device *device, 
		dev_info(device,

			"%s: Device not supported by the driver %d\n",

			__func__, -ENODEV);

		goto free_m;

		return size;

	}



	ret = SLAVE_SPECIFIC_FUNC(sl)->write_data(sl, new_config_register);
@@ -1922,10 +1904,6 @@ static ssize_t alarms_store(struct device *device, 
			"%s: error writing to the slave device %d\n",

			__func__, ret);



free_m:

	/* free allocated memory */

	kfree(orig);



	return size;

}

drivers/w1/w1.c

+0 −2
Original line number Diff line number Diff line
@@ -758,8 +758,6 @@ int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn) 
	if (err < 0) {

		dev_err(&dev->dev, "%s: Attaching %s failed.\n", __func__,

			 sl->name);

		dev->slave_count--;

		w1_family_put(sl->family);

		atomic_dec(&sl->master->refcnt);

		kfree(sl);

		return err;