summaryrefslogtreecommitdiffstats
path: root/drivers/gpio
diff options
context:
space:
mode:
authorLars-Peter Clausen <lars@metafoo.de>2016-10-18 16:53:59 +0200
committerLinus Walleij <linus.walleij@linaro.org>2016-10-21 14:36:44 +0200
commit1f1cc4566bd9dd8d3cf19965a4b6392143618536 (patch)
tree60ddc9a54e71d504c2ac0d2e79ceee6df0acd734 /drivers/gpio
parent67bf5156edc4f58241fd7c119ae145c552adddd6 (diff)
downloadlinux-stable-1f1cc4566bd9dd8d3cf19965a4b6392143618536.tar.gz
linux-stable-1f1cc4566bd9dd8d3cf19965a4b6392143618536.tar.bz2
linux-stable-1f1cc4566bd9dd8d3cf19965a4b6392143618536.zip
gpio: GPIO_GET_CHIPINFO_IOCTL: Fix line offset validation
The current line offset validation is off by one. Depending on the data stored behind the descs array this can either cause undefined behavior or disclose arbitrary, potentially sensitive, memory to the issuing userspace application. Make sure that offset is within the bounds of the desc array. Cc: stable@vger.kernel.org Fixes: 521a2ad6f862 ("gpio: add userspace ABI for GPIO line information") Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Diffstat (limited to 'drivers/gpio')
-rw-r--r--drivers/gpio/gpiolib.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index f0fc3a0d37c8..dac975397253 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -839,7 +839,7 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
if (copy_from_user(&lineinfo, ip, sizeof(lineinfo)))
return -EFAULT;
- if (lineinfo.line_offset > gdev->ngpio)
+ if (lineinfo.line_offset >= gdev->ngpio)
return -EINVAL;
desc = &gdev->descs[lineinfo.line_offset];