Unverified Commit 1ad25d9d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!973 [sync] PR-969: kobject: Fix slab-out-of-bounds in fill_kobj_path() 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/969 
 
PR sync from:  Xia Fukun <xiafukun@huawei.com>
 https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/thread/BKNZ3SWVHTMMTKLWPREORX4R6EEUURB6/ 
 
 
Link:https://gitee.com/openeuler/kernel/pulls/973

 

Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 44aa1e9f 979dd789

lib/kobject.c

+10 −2
Original line number Diff line number Diff line
@@ -144,7 +144,7 @@ static int get_kobj_path_length(struct kobject *kobj) 
	return length;

}



static void fill_kobj_path(struct kobject *kobj, char *path, int length)

static int fill_kobj_path(struct kobject *kobj, char *path, int length)

{

	struct kobject *parent;
@@ -153,12 +153,16 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length) 
		int cur = strlen(kobject_name(parent));

		/* back up enough to print this name with '/' */

		length -= cur;

		if (length <= 0)

			return -EINVAL;

		memcpy(path + length, kobject_name(parent), cur);

		*(path + --length) = '/';

	}



	pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj),

		 kobj, __func__, path);



	return 0;

}



/**
@@ -173,13 +177,17 @@ char *kobject_get_path(struct kobject *kobj, gfp_t gfp_mask) 
	char *path;

	int len;



retry:

	len = get_kobj_path_length(kobj);

	if (len == 0)

		return NULL;

	path = kzalloc(len, gfp_mask);

	if (!path)

		return NULL;

	fill_kobj_path(kobj, path, len);

	if (fill_kobj_path(kobj, path, len)) {

		kfree(path);

		goto retry;

	}



	return path;

}