Home Home > GIT Browse > SLE12-SP3
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2018-07-09 10:55:17 +0200
committerTakashi Iwai <tiwai@suse.de>2018-07-09 10:55:17 +0200
commit743a46fa13f32f839a710b78dad4dfecdc30350c (patch)
treebeb457e93be6505ca841f5e438a699a13a6de6d8
parent8a2422091597e35f407f2a19d6b7a89affac0d11 (diff)
ARM: amba: Don't read past the end of sysfs "driver_override"
buffer (CVE-2018-9385,bsc#1100491). suse-commit: ba06e3b6a40b545f00481a9b3c0ed5fbd7ea9070
-rw-r--r--drivers/amba/bus.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index f0099360039e..42086ad535c5 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -82,7 +82,8 @@ static ssize_t driver_override_store(struct device *_dev,
struct amba_device *dev = to_amba_device(_dev);
char *driver_override, *old = dev->driver_override, *cp;
- if (count > PATH_MAX)
+ /* We need to keep extra room for a newline */
+ if (count >= (PAGE_SIZE - 1))
return -EINVAL;
driver_override = kstrndup(buf, count, GFP_KERNEL);