diff options
| author | Dan Carpenter <[email protected]> | 2024-06-06 16:12:11 +0300 |
|---|---|---|
| committer | Tzung-Bi Shih <[email protected]> | 2024-06-07 09:57:44 +0000 |
| commit | 1f72dd046270ff44e5fd43045c4d0bb025f88607 (patch) | |
| tree | fe86a678966d117ffed2c7b7ec2a907223bca7d1 | |
| parent | 04ca0a51f1e63bd553fd4af8e9af0fe094fa4f0a (diff) | |
hwmon: (cros_ec) Prevent read overflow in probe()
The "resp.sensor_name" comes from cros_ec_cmd() and it hasn't necessarily
been NUL terminated. We had not intended to read past "sensor_name_size"
bytes, however, there is a width vs precision bug in the format string.
The format needs to be precision '%.*s' instead of width '%*s'.
Precision prevents an out of bounds read, but width is a no-op.
Fixes: bc3e45258096 ("hwmon: add ChromeOS EC driver")
Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Guenter Roeck <[email protected]>
Acked-by: Thomas Weißschuh <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Tzung-Bi Shih <[email protected]>
| -rw-r--r-- | drivers/hwmon/cros_ec_hwmon.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hwmon/cros_ec_hwmon.c b/drivers/hwmon/cros_ec_hwmon.c index 41f268fa8260..b3ba7247e06b 100644 --- a/drivers/hwmon/cros_ec_hwmon.c +++ b/drivers/hwmon/cros_ec_hwmon.c @@ -212,7 +212,7 @@ static void cros_ec_hwmon_probe_temp_sensors(struct device *dev, struct cros_ec_ continue; sensor_name_size = strnlen(resp.sensor_name, sizeof(resp.sensor_name)); - priv->temp_sensor_names[i] = devm_kasprintf(dev, GFP_KERNEL, "%*s", + priv->temp_sensor_names[i] = devm_kasprintf(dev, GFP_KERNEL, "%.*s", (int)sensor_name_size, resp.sensor_name); } |