From nobody Wed Dec 17 10:54:32 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1C06C32772 for ; Tue, 23 Aug 2022 10:50:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355818AbiHWKuQ (ORCPT ); Tue, 23 Aug 2022 06:50:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49476 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356003AbiHWKlQ (ORCPT ); Tue, 23 Aug 2022 06:41:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 466877A513; Tue, 23 Aug 2022 02:08:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EB8E96159A; Tue, 23 Aug 2022 09:08:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2866C43470; Tue, 23 Aug 2022 09:08:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661245719; bh=CmcPK2lc47Okxh9b7fsrFvpDKb/n652OLhI6HxQ2s24=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Eumgf7y4u1pluaQWB3qc5k18+mWgyN4xHBsrLQkSpMvgAA/WLV6AP+h5uwklQ9kZB 8w/5UHQyVlY4GChXITlZ3BAR85KasnqJTfM4ag0btnGJ9bQigua7o/+D//SjSaifhu bVHl8W+/Ok9b3Io4hwSgiMBMYNQYanhU6grWiaMI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Hans de Goede , Sasha Levin Subject: [PATCH 4.19 140/287] platform/olpc: Fix uninitialized data in debugfs write Date: Tue, 23 Aug 2022 10:25:09 +0200 Message-Id: <20220823080105.210845527@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080100.268827165@linuxfoundation.org> References: <20220823080100.268827165@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit 40ec787e1adf302c11668d4cc69838f4d584187d ] The call to: size =3D simple_write_to_buffer(cmdbuf, sizeof(cmdbuf), ppos, buf, size); will succeed if at least one byte is written to the "cmdbuf" buffer. The "*ppos" value controls which byte is written. Another problem is that this code does not check for errors so it's possible for the entire buffer to be uninitialized. Inintialize the struct to zero to prevent reading uninitialized stack data. Debugfs is normally only writable by root so the impact of this bug is very minimal. Fixes: 6cca83d498bd ("Platform: OLPC: move debugfs support from x86 EC driv= er") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YthIKn+TfZSZMEcM@kili Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Sasha Levin --- drivers/platform/olpc/olpc-ec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-e= c.c index 374a8028fec7..b36a000ed969 100644 --- a/drivers/platform/olpc/olpc-ec.c +++ b/drivers/platform/olpc/olpc-ec.c @@ -170,7 +170,7 @@ static ssize_t ec_dbgfs_cmd_write(struct file *file, co= nst char __user *buf, int i, m; unsigned char ec_cmd[EC_MAX_CMD_ARGS]; unsigned int ec_cmd_int[EC_MAX_CMD_ARGS]; - char cmdbuf[64]; + char cmdbuf[64] =3D ""; int ec_cmd_bytes; =20 mutex_lock(&ec_dbgfs_lock); --=20 2.35.1