Bug 217169
Summary: | BUG: binary data included in HID-SENSOR device name taints ftrace | ||
---|---|---|---|
Product: | Drivers | Reporter: | Todd Brandt (todd.e.brandt) |
Component: | Input Devices | Assignee: | drivers_input-devices |
Status: | NEW --- | ||
Severity: | normal | CC: | p.jungkamp |
Priority: | P1 | ||
Hardware: | All | ||
OS: | Linux | ||
Kernel Version: | 6.3.0-rc1 | Subsystem: | |
Regression: | No | Bisected commit-id: | |
Bug Depends on: | |||
Bug Blocks: | 178231 |
Description
Todd Brandt
2023-03-09 23:43:18 UTC
I spoke with Phillip and he came up with a fix that works. I've posted it here: https://marc.info/?l=linux-iio&m=167849244508779&w=2 I've tested it and it fixes the issue. The problem was with a buffer overrun because the destination string wasn't initialized to 0. It's 5 bytes long with 4 bytes copied and the code expected the 5th byte to be a null char. diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c index 3e3f89e01d81..d85398721659 100644 --- a/drivers/hid/hid-sensor-custom.c +++ b/drivers/hid/hid-sensor-custom.c @@ -940,7 +940,7 @@ hid_sensor_register_platform_device(struct platform_device *pdev, struct hid_sensor_hub_device *hsdev, const struct hid_sensor_custom_match *match) { - char real_usage[HID_SENSOR_USAGE_LENGTH]; + char real_usage[HID_SENSOR_USAGE_LENGTH] = { 0 }; struct platform_device *custom_pdev; const char *dev_name; char *c; |