On Thu, Aug 18, 2022 at 10:20 PM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> If "s_mem.bytes" is larger than the buffer size it leads to memory
> corruption.
>
> Fixes: eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Reviewed-by: Guenter Roeck <groeck@xxxxxxxxxxxx>
> ---
> drivers/platform/chrome/cros_ec_chardev.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/platform/chrome/cros_ec_chardev.c b/drivers/platform/chrome/cros_ec_chardev.c
> index fd33de546aee..2442dce4e208 100644
> --- a/drivers/platform/chrome/cros_ec_chardev.c
> +++ b/drivers/platform/chrome/cros_ec_chardev.c
> @@ -327,6 +327,9 @@ static long cros_ec_chardev_ioctl_readmem(struct cros_ec_dev *ec,
> if (copy_from_user(&s_mem, arg, sizeof(s_mem)))
> return -EFAULT;
>
> + if (s_mem.bytes > sizeof(s_mem.buffer))
> + return -EINVAL;
> +
> num = ec_dev->cmd_readmem(ec_dev, s_mem.offset, s_mem.bytes,
> s_mem.buffer);
> if (num <= 0)
> --
> 2.35.1
>
