Skip to content

Commit 601e3f6

Browse files
author
liwei
committed
[16859]:[BSP][Stability][KASAN] Fix proc_restart_level_all_write bug. BUG: KASAN: stack-out-of-bounds in _parse_integer+0x3c/0xd8 at addr ffffffc13dcd7bd1
Plan: BUG: KASAN: stack-out-of-bounds in _parse_integer+0x3c/0xd8 at addr ffffffc13dc 663602]@0 Read of size 1 by task init/1 page: ffffffbdc4f735c0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x4000000000000000() 663660]@0 page dumped because: kasan: bad access detected CPU: 0 PID: 1 Comm: init Tainted: G W 4.4.21-aging+ OnePlusOSS#7 @0 Hardware name: Qualcomm Technologies, Inc. MSM 8998 v2.1 MTP (DT) @0 Call trace: [<ffffff900808abc0>] dump_backtrace+0x0/0x2f4 [<ffffff900808aed8>] show_stack+0x24/0x30 [<ffffff900853d274>] dump_stack+0xbc/0xf8 [<ffffff90082733dc>] kasan_report+0x3a8/0x4f0 [<ffffff90082727b8>] __asan_load1+0x24/0x50 [<ffffff900855df0c>] _parse_integer+0x3c/0xd8 [<ffffff9008549fdc>] simple_strtoull+0x98/0xf0 [<ffffff900854aeb4>] simple_strtoll+0x4c/0x5c [<ffffff900854b4c8>] vsscanf+0x604/0x87c [<ffffff900854b7ec>] sscanf+0xac/0xd8 [<ffffff90087f17dc>] proc_restart_level_all_write+0xf4/0x318 [<ffffff9008307548>] proc_reg_write+0xc0/0xf0 [<ffffff90082844c0>] __vfs_write+0xe4/0x208 [<ffffff900828510c>] vfs_write+0xec/0x1c4 [<ffffff9008286088>] SyS_write+0xdc/0x158 [<ffffff9008085630>] el0_svc_naked+0x24/0x28 Type: BUG Test: Do aging test * Change-Id: I9dcba507cce375342f7d3c3a8e56d04e1fe45847
1 parent 78fac85 commit 601e3f6

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/soc/qcom/subsystem_restart.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -697,7 +697,7 @@ static ssize_t proc_restart_level_all_read(struct file *p_file, char __user *pus
697697
static ssize_t proc_restart_level_all_write(struct file *p_file, const char __user *puser_buf,
698698
size_t count, loff_t *p_offset)
699699
{
700-
char temp[1] = {0};
700+
char temp[2] = {0};
701701
struct subsys_device *subsys;
702702

703703
if (copy_from_user(temp, puser_buf, 1))

0 commit comments

Comments
 (0)