diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2024-12-13 15:07:22 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2024-12-13 15:07:22 -0800 |
| commit | 1c021e7908cc6683a1fcbd26eb02bc8c7c880da0 (patch) | |
| tree | 9ead9478b784343d926ed6ce79e904dd6f3a095a | |
| parent | 4800575d8c0b2f354ab05ab1c4749e45e213bf73 (diff) | |
| parent | 265e98f72bac6c41a4492d3e30a8e5fd22fe0779 (diff) | |
Merge tag 'libnvdimm-fixes-6.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
Pull libnvdimm fix from Ira Weiny:
- sysbot fix for out of bounds access
* tag 'libnvdimm-fixes-6.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
| -rw-r--r-- | drivers/acpi/nfit/core.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 5429ec9ef06f..a5d47819b3a4 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -454,8 +454,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, if (cmd_rc) *cmd_rc = -EINVAL; - if (cmd == ND_CMD_CALL) + if (cmd == ND_CMD_CALL) { + if (!buf || buf_len < sizeof(*call_pkg)) + return -EINVAL; + call_pkg = buf; + } + func = cmd_to_func(nfit_mem, cmd, call_pkg, &family); if (func < 0) return func; |