summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorMuchun Song <smuchun@gmail.com>2018-11-01 21:12:50 +0800
committerLinus Walleij <linus.walleij@linaro.org>2018-11-05 08:54:42 +0100
commit18534df419041e6c1f4b41af56ee7d41f757815c (patch)
tree07b00d6af2d33db869f1bb53f6da1f28ad11b473 /lib
parent02cb87f79b6dfd17bb16b71ec30652e76c6d8cf2 (diff)
gpiolib: Fix possible use after free on label
gpiod_request_commit() copies the pointer to the label passed as an argument only to be used later. But there's a chance the caller could immediately free the passed string(e.g., local variable). This could trigger a use after free when we use gpio label(e.g., gpiochip_unlock_as_irq(), gpiochip_is_requested()). To be on the safe side: duplicate the string with kstrdup_const() so that if an unaware user passes an address to a stack-allocated buffer, we won't get the arbitrary label. Also fix gpiod_set_consumer_name(). Signed-off-by: Muchun Song <smuchun@gmail.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Diffstat (limited to 'lib')
0 files changed, 0 insertions, 0 deletions