lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()

Browse Source 
We always put a NUL terminator one space past the end of the "vendor"
buffer.  Walter Harms also pointed out that this should just use
kstrndup().

Fixes: 7d17c02a01 ('mtd: Add new SmartMedia/xD FTL')

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
This commit is contained in:
Dan Carpenter
2013-12-05 17:53:50 +03:00
committed by Brian Norris
parent f5e00838e8
commit b4c2330577
1 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/mtd/sm_ftl.c
View File

@@ -59,15 +59,12 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
struct attribute_group *attr_group; struct attribute_group *attr_group;
struct attribute **attributes; struct attribute **attributes;
struct sm_sysfs_attribute *vendor_attribute; struct sm_sysfs_attribute *vendor_attribute;
char *vendor;
int vendor_len = strnlen(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET, vendor = kstrndup(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,
SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET); SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET, GFP_KERNEL);
char *vendor = kmalloc(vendor_len, GFP_KERNEL);
if (!vendor) if (!vendor)
goto error1; goto error1;
memcpy(vendor, ftl->cis_buffer + SM_CIS_VENDOR_OFFSET, vendor_len);
vendor[vendor_len] = 0;
/* Initialize sysfs attributes */ /* Initialize sysfs attributes */
vendor_attribute = vendor_attribute =
@@ -78,7 +75,7 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
sysfs_attr_init(&vendor_attribute->dev_attr.attr); sysfs_attr_init(&vendor_attribute->dev_attr.attr);
vendor_attribute->data = vendor; vendor_attribute->data = vendor;
vendor_attribute->len = vendor_len; vendor_attribute->len = strlen(vendor);
vendor_attribute->dev_attr.attr.name = "vendor"; vendor_attribute->dev_attr.attr.name = "vendor";
vendor_attribute->dev_attr.attr.mode = S_IRUGO; vendor_attribute->dev_attr.attr.mode = S_IRUGO;
vendor_attribute->dev_attr.show = sm_attr_show; vendor_attribute->dev_attr.show = sm_attr_show;