diff options
| author |   Gustavo A. R. Silva <gustavo@embeddedor.com> | 2020-01-28 20:26:13 -0600 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-01-30 06:58:33 +0100 |
| commit | 98c49f1746ac44ccc164e914b9a44183fad09f51 (patch) | |
| tree | e39e80575f9e1843e68cababebcc8de70fe32b73 | |
| parent | Merge branch 'urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu (diff) | |
| download | linux-dev-98c49f1746ac44ccc164e914b9a44183fad09f51.tar.xz linux-dev-98c49f1746ac44ccc164e914b9a44183fad09f51.zip | |
char: hpet: Fix out-of-bounds read bug
Currently, there is an out-of-bounds read on array hpetp->hp_dev
in the following for loop:
870 for (i = 0; i < hdp->hd_nirqs; i++)
871 hpetp->hp_dev[i].hd_hdwirq = hdp->hd_irq[i];
This is due to the recent change from one-element array to
flexible-array member in struct hpets:
104 struct hpets {
...
113 struct hpet_dev hp_dev[];
114 };
This change affected the total size of the dynamic memory
allocation, decreasing it by one time the size of struct hpet_dev.
Fix this by adjusting the allocation size when calling
struct_size().
Fixes: 987f028b8637c ("char: hpet: Use flexible-array member")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Eric Biggers <ebiggers@kernel.org>
Link: https://lore.kernel.org/r/20200129022613.GA24281@embeddedor.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to '')
| -rw-r--r-- | drivers/char/hpet.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c index aed2c45f7968..ed3b7dab678d 100644 --- a/drivers/char/hpet.c +++ b/drivers/char/hpet.c @@ -855,7 +855,7 @@ int hpet_alloc(struct hpet_data *hdp) return 0; } - hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs - 1), + hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs), GFP_KERNEL); if (!hpetp) |