Re: [PATCH] staging: greybus: power_supply: fix prop-descriptor request size

Rui Miguel Silva <rui.silva@xxxxxxxxxx> · Thu, 04 Apr 2019 08:06:53 +0100

Hi Johan,
Thanks for the patch.

On Thu 04 Apr 2019 at 07:53, Johan Hovold wrote:

Since moving the message buffers off the stack, the dynamically

allocated get-prop-descriptor request buffer is incorrectly 

sized due to

using the pointer rather than request-struct size when creating 

the

operation.


Fortunately, the pointer size is always larger than this 

one-byte

request, but this could still cause trouble on the remote end 

due to the

unexpected message size.


Fixes: 9d15134d067e ("greybus: power_supply: rework get 

descriptors")

Cc: stable <stable@xxxxxxxxxxxxxxx>     # 4.9
Cc: Rui Miguel Silva <rui.silva@xxxxxxxxxx>
Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>


Nice catch. LGTM.

Reviewed-by: Rui Miguel Silva <rmfrfs@xxxxxxxxx>

---
Cheers,
	Rui



---
 drivers/staging/greybus/power_supply.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/greybus/power_supply.c 

b/drivers/staging/greybus/power_supply.c

index 0529e5628c24..ae5c0285a942 100644
--- a/drivers/staging/greybus/power_supply.c
+++ b/drivers/staging/greybus/power_supply.c

@@ -520,7 +520,7 @@ static int 

gb_power_supply_prop_descriptors_get(struct gb_power_supply 

*gbpsy)

 

 	op = gb_operation_create(connection,

 				 GB_POWER_SUPPLY_TYPE_GET_PROP_DESCRIPTORS,

-				 sizeof(req), sizeof(*resp) + 

props_count *

+				 sizeof(*req), sizeof(*resp) + 

props_count *

 				 sizeof(struct 

 gb_power_supply_props_desc),

 				 GFP_KERNEL);
 	if (!op)


_______________________________________________
greybus-dev mailing list
greybus-dev@xxxxxxxxxxxxxxxx
https://lists.linaro.org/mailman/listinfo/greybus-dev



