Skip to content

Commit 40ec787

Browse files
Dan Carpenterjwrdegoede
authored andcommitted
platform/olpc: Fix uninitialized data in debugfs write
The call to: size = simple_write_to_buffer(cmdbuf, sizeof(cmdbuf), ppos, buf, size); will succeed if at least one byte is written to the "cmdbuf" buffer. The "*ppos" value controls which byte is written. Another problem is that this code does not check for errors so it's possible for the entire buffer to be uninitialized. Inintialize the struct to zero to prevent reading uninitialized stack data. Debugfs is normally only writable by root so the impact of this bug is very minimal. Fixes: 6cca83d ("Platform: OLPC: move debugfs support from x86 EC driver") Signed-off-by: Dan Carpenter <[email protected]> Link: https://lore.kernel.org/r/YthIKn+TfZSZMEcM@kili Reviewed-by: Hans de Goede <[email protected]> Signed-off-by: Hans de Goede <[email protected]>
1 parent b4b830a commit 40ec787

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/platform/olpc/olpc-ec.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ static ssize_t ec_dbgfs_cmd_write(struct file *file, const char __user *buf,
264264
int i, m;
265265
unsigned char ec_cmd[EC_MAX_CMD_ARGS];
266266
unsigned int ec_cmd_int[EC_MAX_CMD_ARGS];
267-
char cmdbuf[64];
267+
char cmdbuf[64] = "";
268268
int ec_cmd_bytes;
269269

270270
mutex_lock(&ec_dbgfs_lock);

0 commit comments

Comments
 (0)