[PATCH v3 04/12] i2c-mux-pca954x: fix out-of-bounds write for 64 bit systems

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



get_drv_data(..., &data->type) overwrites memory beyond data->type member due
to mismatch of sizeof(enum pca_type) and sizeof(void *) on 64 bit systems.

Signed-off-by: Peter Mamonov <pmamonov@xxxxxxxxx>
---
 drivers/i2c/muxes/i2c-mux-pca954x.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c
index 0d5515b71..395254cdc 100644
--- a/drivers/i2c/muxes/i2c-mux-pca954x.c
+++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
@@ -180,6 +180,7 @@ static int pca954x_probe(struct device_d *dev)
 	struct i2c_adapter *adap = to_i2c_adapter(client->dev.parent);
 	int num, force;
 	struct pca954x *data;
+	uintptr_t tmp;
 	int ret = -ENODEV;
 	int gpio;
 
@@ -203,7 +204,8 @@ static int pca954x_probe(struct device_d *dev)
 		goto exit_free;
 	}
 
-	ret = dev_get_drvdata(dev, (const void **)&data->type);
+	ret = dev_get_drvdata(dev, (const void **)&tmp);
+	data->type = tmp;
 	if (ret)
 		goto exit_free;
 
-- 
2.17.0


_______________________________________________
barebox mailing list
barebox@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/barebox



[Index of Archives]     [Linux Embedded]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux