summaryrefslogtreecommitdiffstats
path: root/drivers/base
diff options
context:
space:
mode:
authorLuis R. Rodriguez <mcgrof@suse.com>2015-05-12 14:49:41 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2015-05-24 12:36:34 -0700
commit1ba4de17e0cb9cc3e03ce5b1fafebdd01c48c1f2 (patch)
treeda801efb3c2e146afbba27de9eb59274b3836b8b /drivers/base
parentf5727b05d221796baf69667ed5c891d4bd53711e (diff)
downloadlinux-1ba4de17e0cb9cc3e03ce5b1fafebdd01c48c1f2.tar.bz2
firmware: check for file truncation on direct firmware loading
When direct firmware loading is used we iterate over a list of possible firmware paths and concatenate the desired firmware name with each path and look for the file there. Should the passed firmware name be too long we end up truncating the file we want to look for, the search however is still done. Add a check for truncation instead of looking for a truncated firmware filename. Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Ming Lei <ming.lei@canonical.com> Cc: Rusty Russell <rusty@rustcorp.com.au> Cc: David Howells <dhowells@redhat.com> Cc: Kyle McMartin <kyle@kernel.org> Signed-off-by: Luis R. Rodriguez <mcgrof@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/base')
-rw-r--r--drivers/base/firmware_class.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 49139a1ee25e..9ffa70762473 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -320,7 +320,7 @@ fail:
static int fw_get_filesystem_firmware(struct device *device,
struct firmware_buf *buf)
{
- int i;
+ int i, len;
int rc = -ENOENT;
char *path;
@@ -335,7 +335,12 @@ static int fw_get_filesystem_firmware(struct device *device,
if (!fw_path[i][0])
continue;
- snprintf(path, PATH_MAX, "%s/%s", fw_path[i], buf->fw_id);
+ len = snprintf(path, PATH_MAX, "%s/%s",
+ fw_path[i], buf->fw_id);
+ if (len >= PATH_MAX) {
+ rc = -ENAMETOOLONG;
+ break;
+ }
file = filp_open(path, O_RDONLY, 0);
if (IS_ERR(file))