summaryrefslogtreecommitdiff
path: root/drivers/char/hpet.c
diff options
context:
space:
mode:
authorGustavo A. R. Silva <gustavo@embeddedor.com>2020-01-28 20:26:13 -0600
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-01-30 06:58:33 +0100
commit98c49f1746ac44ccc164e914b9a44183fad09f51 (patch)
treee39e80575f9e1843e68cababebcc8de70fe32b73 /drivers/char/hpet.c
parent15d6632496537fa66488221ee5dd2f9fb318ef2e (diff)
char: hpet: Fix out-of-bounds read bug
Currently, there is an out-of-bounds read on array hpetp->hp_dev in the following for loop: 870 for (i = 0; i < hdp->hd_nirqs; i++) 871 hpetp->hp_dev[i].hd_hdwirq = hdp->hd_irq[i]; This is due to the recent change from one-element array to flexible-array member in struct hpets: 104 struct hpets { ... 113 struct hpet_dev hp_dev[]; 114 }; This change affected the total size of the dynamic memory allocation, decreasing it by one time the size of struct hpet_dev. Fix this by adjusting the allocation size when calling struct_size(). Fixes: 987f028b8637c ("char: hpet: Use flexible-array member") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Acked-by: Eric Biggers <ebiggers@kernel.org> Link: https://lore.kernel.org/r/20200129022613.GA24281@embeddedor.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/char/hpet.c')
-rw-r--r--drivers/char/hpet.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index aed2c45f7968..ed3b7dab678d 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -855,7 +855,7 @@ int hpet_alloc(struct hpet_data *hdp)
return 0;
}
- hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs - 1),
+ hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs),
GFP_KERNEL);
if (!hpetp)