Unverified Commit dcd508c8 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14843 acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl 

Merge Pull Request from: @ci-robot 
 
PR sync from: Heyuan Wang <wangheyuan2@h-partners.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/TIV3RUHHH7AJWBRSW7XQJPCPQMUTK24W/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBEAMX 
 
Link:https://gitee.com/openeuler/kernel/pulls/14843

 

Reviewed-by: default avatarWang ShaoBo <bobo.shaobowang@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 3bfb552d 5f8cbd77

drivers/acpi/nfit/core.c

+6 −1
Original line number Diff line number Diff line
@@ -440,8 +440,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, 
	if (cmd_rc)

		*cmd_rc = -EINVAL;



	if (cmd == ND_CMD_CALL)

	if (cmd == ND_CMD_CALL) {

		if (!buf || buf_len < sizeof(*call_pkg))

			return -EINVAL;



		call_pkg = buf;

	}



	func = cmd_to_func(nfit_mem, cmd, call_pkg);

	if (func < 0)

		return func;