From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1163409AbbKTR0n (ORCPT ); Fri, 20 Nov 2015 12:26:43 -0500 Received: from mout.kundenserver.de ([212.227.17.13]:54180 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1162739AbbKTR0k (ORCPT ); Fri, 20 Nov 2015 12:26:40 -0500 From: Arnd Bergmann To: Ohad Ben-Cohen Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Fernando Guzman Lugo , Fernando Guzman Lugo Subject: [PATCH] remoteproc: avoid stack overflow in debugfs file Date: Fri, 20 Nov 2015 18:26:07 +0100 Message-ID: <10169860.4GdufNCNz1@wuerfel> User-Agent: KMail/4.11.5 (Linux/3.16.0-10-generic; KDE/4.11.5; x86_64; ; ) MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" X-Provags-ID: V03:K0:IFiWXb4idNDXQ8XOvLoNDPdjLm95OzoM+OBiv4ZS80HGU2HS2lT ys0oNU5wdTkKPkzt6F1U2Dzl7rqcyvblFeduoA3Uf9xX/RtEj9dsmcTWuAh7apn7ye5Izfm RMXKoG3ENta+BrX2AvXUPZKSp+BjYV2BJTMT/tbMRexFQAe4KG/pHx7Dbhd+LHjHnuvols+ xlrAYBzxF6gUP9/y1kfLA== X-UI-Out-Filterresults: notjunk:1;V01:K0:38MiP4hYz0k=:lUJoo1bHG983ipQxMBKG+p 4kooIBGcssx6EWNi+E4yEDcNzCBqnj23diQXHPLFnQ81UFsOgvlqOiATJ32yPeLvcvq+kagD9 jydE4UPKjwq7VD9roYd9Vi43Ebj2wQTSuwjpnKbHNSVRV+RrsczvMcL/cehBuc+vvonkYcfGa crNEkvWRVSEQC+nGSGVZoGkbOo/aAYZS2sTOMFWgWBYxhlxfN+QqJqRrVvU7S7/ldgnm2zqzA p0WKz62wn0qRo70WSDIP/rrY2qOGFfVBpAGpBbXQo6MsQwO6t+8ggE5ubOX+TusAoxIjKlIIn dIngYYJwp1rgIIN42vfKsPnKZndJDGhRITn70cWuVta6wY0GTnkrMd9+jSK8jD7HMTeCzbG8v oU/7FUsu/KHPInX+v5ybaXpN8RxFPWc5/3opr5gsrmGrlx5YtdWRT6/vMHZsnI94J7QtNsn3w v+50nOjrPPSNHFrkPwHl4byCvmJsKmOM6BbpXlGnirXSBuMfSDSYBlcxX0+N8dvE385zbKkDc ZFaM0ZIl5MQSabjrW6nRlKY1r8E4BU1nCsrAXBqkomE18PVMTzvNcS3qJJNrlfwBCCjUqN9sK AkYfrlF+hl2mJ/WMtmbCimEDYHg6ZE7BTUu8Qu3mUxaR2qCnfLMs15zUpIvVGrn0dVY9hKuKZ A+93cOzMrpO7bHEgzHkZbJrhp3Fqj2jY+9NH/2BG7e/Vpfb75qFugKAxdCgfGOmCKGNrWOoX9 hHHOOXt+RvN/1exH Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Recent gcc versions warn about reading from a negative offset of an on-stack array: drivers/remoteproc/remoteproc_debugfs.c: In function 'rproc_recovery_write': drivers/remoteproc/remoteproc_debugfs.c:167:9: warning: 'buf[4294967295u]' may be used uninitialized in this function [-Wmaybe-uninitialized] I don't see anything in sys_write() that prevents us from being called with a zero 'count' argument, so we should add an extra check in rproc_recovery_write() to prevent the access and avoid the warning. Signed-off-by: Arnd Bergmann Fixes: 2e37abb89a2e ("remoteproc: create a 'recovery' debugfs entry") diff --git a/drivers/remoteproc/remoteproc_debugfs.c b/drivers/remoteproc/remoteproc_debugfs.c index 9d30809bb407..916af5096f57 100644 --- a/drivers/remoteproc/remoteproc_debugfs.c +++ b/drivers/remoteproc/remoteproc_debugfs.c @@ -156,7 +156,7 @@ rproc_recovery_write(struct file *filp, const char __user *user_buf, char buf[10]; int ret; - if (count > sizeof(buf)) + if (count < 1 || count > sizeof(buf)) return count; ret = copy_from_user(buf, user_buf, count);