From: Gustavo A. R. Silva Date: Wed, 29 Jan 2020 02:26:13 +0000 (-0600) Subject: char: hpet: Fix out-of-bounds read bug X-Git-Tag: baikal/mips/sdk5.9~14373^2 X-Git-Url: https://git.baikalelectronics.ru/sdk/?a=commitdiff_plain;h=81b73480b256fc9bf5b70537f521ca7206439f5d;p=kernel.git char: hpet: Fix out-of-bounds read bug Currently, there is an out-of-bounds read on array hpetp->hp_dev in the following for loop: 870 for (i = 0; i < hdp->hd_nirqs; i++) 871 hpetp->hp_dev[i].hd_hdwirq = hdp->hd_irq[i]; This is due to the recent change from one-element array to flexible-array member in struct hpets: 104 struct hpets { ... 113 struct hpet_dev hp_dev[]; 114 }; This change affected the total size of the dynamic memory allocation, decreasing it by one time the size of struct hpet_dev. Fix this by adjusting the allocation size when calling struct_size(). Fixes: 94a8c6bdee4ba ("char: hpet: Use flexible-array member") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Tetsuo Handa Acked-by: Eric Biggers Link: https://lore.kernel.org/r/20200129022613.GA24281@embeddedor.com Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c index aed2c45f7968c..ed3b7dab678db 100644 --- a/drivers/char/hpet.c +++ b/drivers/char/hpet.c @@ -855,7 +855,7 @@ int hpet_alloc(struct hpet_data *hdp) return 0; } - hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs - 1), + hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs), GFP_KERNEL); if (!hpetp)