Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

platform/olpc: Fix uninitialized data in debugfs write

The call to:

size = simple_write_to_buffer(cmdbuf, sizeof(cmdbuf), ppos, buf, size);

will succeed if at least one byte is written to the "cmdbuf" buffer.
The "*ppos" value controls which byte is written. Another problem is
that this code does not check for errors so it's possible for the entire
buffer to be uninitialized.

Inintialize the struct to zero to prevent reading uninitialized stack
data.

Debugfs is normally only writable by root so the impact of this bug is
very minimal.

Fixes: 6cca83d498bd ("Platform: OLPC: move debugfs support from x86 EC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YthIKn+TfZSZMEcM@kili
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>

authored by

Dan Carpenter and committed by
Hans de Goede
40ec787e b4b830a3

+1 -1
+1 -1
drivers/platform/olpc/olpc-ec.c
··· 264 264 int i, m; 265 265 unsigned char ec_cmd[EC_MAX_CMD_ARGS]; 266 266 unsigned int ec_cmd_int[EC_MAX_CMD_ARGS]; 267 - char cmdbuf[64]; 267 + char cmdbuf[64] = ""; 268 268 int ec_cmd_bytes; 269 269 270 270 mutex_lock(&ec_dbgfs_lock);