platform/chrome: cros_ec_dev - Fix security issue

Browse source

Prevent memory scribble by checking that ioctl buffer size parameters
are sane.
Without this check, on 32 bits system, if .insize = 0xffffffff - 20 and
.outsize the amount to scribble, we would overflow, allocate a small
amounts and be able to write outside of the malloc'ed area.
Adding a hard limit allows argument checking of the ioctl. With the
current EC, it is expected .insize and .outsize to be at around 512 bytes
or less.

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Signed-off-by: Olof Johansson <olof@lixom.net>

...

This commit is contained in:

Gwendal Grignou 2016-03-08 09:13:52 -08:00 • committed by Olof Johansson

parent 492ef7829d

commit 5d749d0bbe

3 changed files with 10 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

include/linux/mfd/cros_ec.h

View file