summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMarek BehĂșn <marek.behun@nic.cz>2020-02-15 15:21:30 +0100
committerOlof Johansson <olof@lixom.net>2020-02-15 10:33:19 -0800
commit3bf3c9744694803bd2d6f0ee70a6369b980530fd (patch)
treefd5cfc9f84d65e7b14e8f26bc585416223f19525
parentbab8f1ff17da0701bb580fcb025de6fca0da3dcf (diff)
downloadlinux-3bf3c9744694803bd2d6f0ee70a6369b980530fd.tar.bz2
bus: moxtet: fix potential stack buffer overflow
The input_read function declares the size of the hex array relative to sizeof(buf), but buf is a pointer argument of the function. The hex array is meant to contain hexadecimal representation of the bin array. Link: https://lore.kernel.org/r/20200215142130.22743-1-marek.behun@nic.cz Fixes: 5bc7f990cd98 ("bus: Add support for Moxtet bus") Signed-off-by: Marek BehĂșn <marek.behun@nic.cz> Reported-by: sohu0106 <sohu0106@126.com> Signed-off-by: Olof Johansson <olof@lixom.net>
-rw-r--r--drivers/bus/moxtet.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/bus/moxtet.c b/drivers/bus/moxtet.c
index 15fa293819a0..b20fdcbd035b 100644
--- a/drivers/bus/moxtet.c
+++ b/drivers/bus/moxtet.c
@@ -465,7 +465,7 @@ static ssize_t input_read(struct file *file, char __user *buf, size_t len,
{
struct moxtet *moxtet = file->private_data;
u8 bin[TURRIS_MOX_MAX_MODULES];
- u8 hex[sizeof(buf) * 2 + 1];
+ u8 hex[sizeof(bin) * 2 + 1];
int ret, n;
ret = moxtet_spi_read(moxtet, bin);