diff options
| author | Lars-Peter Clausen <lars@metafoo.de> | 2016-10-18 16:53:59 +0200 |
|---|---|---|
| committer | Linus Walleij <linus.walleij@linaro.org> | 2016-10-21 14:36:44 +0200 |
| commit | 1f1cc4566bd9dd8d3cf19965a4b6392143618536 (patch) | |
| tree | 60ddc9a54e71d504c2ac0d2e79ceee6df0acd734 | |
| parent | 67bf5156edc4f58241fd7c119ae145c552adddd6 (diff) | |
| download | linux-1f1cc4566bd9dd8d3cf19965a4b6392143618536.tar.bz2 | |
gpio: GPIO_GET_CHIPINFO_IOCTL: Fix line offset validation
The current line offset validation is off by one. Depending on the data
stored behind the descs array this can either cause undefined behavior or
disclose arbitrary, potentially sensitive, memory to the issuing userspace
application.
Make sure that offset is within the bounds of the desc array.
Cc: stable@vger.kernel.org
Fixes: 521a2ad6f862 ("gpio: add userspace ABI for GPIO line information")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
| -rw-r--r-- | drivers/gpio/gpiolib.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index f0fc3a0d37c8..dac975397253 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -839,7 +839,7 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) if (copy_from_user(&lineinfo, ip, sizeof(lineinfo))) return -EFAULT; - if (lineinfo.line_offset > gdev->ngpio) + if (lineinfo.line_offset >= gdev->ngpio) return -EINVAL; desc = &gdev->descs[lineinfo.line_offset]; |