Commit 1f1cc456 authored Oct 18, 2016 by Lars-Peter Clausen Committed by Linus Walleij Oct 21, 2016

gpio: GPIO_GET_CHIPINFO_IOCTL: Fix line offset validation



The current line offset validation is off by one. Depending on the data
stored behind the descs array this can either cause undefined behavior or
disclose arbitrary, potentially sensitive, memory to the issuing userspace
application.

Make sure that offset is within the bounds of the desc array.

Cc: stable@vger.kernel.org
Fixes: 521a2ad6 ("gpio: add userspace ABI for GPIO line information")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>

parent 67bf5156

drivers/gpio/gpiolib.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -839,7 +839,7 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)

		if (copy_from_user(&lineinfo, ip, sizeof(lineinfo)))
		return -EFAULT;
		if (lineinfo.line_offset > gdev->ngpio)
		if (lineinfo.line_offset >= gdev->ngpio)
		return -EINVAL;

		desc = &gdev->descs[lineinfo.line_offset];

Admin message