Skip to content

Commit 2874741

Browse files
committed
Merge: CVE-2024-58007: soc: qcom: socinfo: Avoid out of bounds read of serial number
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/6662 ## Summary of Changes Backport `22cf4fae6660` ("soc: qcom: socinfo: Avoid out of bounds read of serial number") to fix CVE-2024-58007, as well as a couple of additional commits to prevent conflicts. ## Approved Development Ticket(s) JIRA: https://issues.redhat.com/browse/RHEL-85597 CVE: CVE-2024-58007 Signed-off-by: Jared Kangas <jkangas@redhat.com> Approved-by: Eric Chanudet <echanude@redhat.com> Approved-by: Radu Rendec <rrendec@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Augusto Caringi <acaringi@redhat.com>
2 parents eddea3c + 88d36db commit 2874741

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

drivers/soc/qcom/socinfo.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -614,10 +614,16 @@ static int qcom_socinfo_probe(struct platform_device *pdev)
614614
qs->attr.revision = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%u.%u",
615615
SOCINFO_MAJOR(le32_to_cpu(info->ver)),
616616
SOCINFO_MINOR(le32_to_cpu(info->ver)));
617-
if (offsetof(struct socinfo, serial_num) <= item_size)
617+
if (!qs->attr.soc_id || !qs->attr.revision)
618+
return -ENOMEM;
619+
620+
if (offsetofend(struct socinfo, serial_num) <= item_size) {
618621
qs->attr.serial_number = devm_kasprintf(&pdev->dev, GFP_KERNEL,
619622
"%u",
620623
le32_to_cpu(info->serial_num));
624+
if (!qs->attr.serial_number)
625+
return -ENOMEM;
626+
}
621627

622628
qs->soc_dev = soc_device_register(&qs->attr);
623629
if (IS_ERR(qs->soc_dev))

0 commit comments

Comments
 (0)