[PATCH v4 4/6] gpio: fix potential out-of-bound write

[Markus Burri]

Check that the input size does not exceed the buffer size.
If a caller write more characters, count is truncated to the max available
space in "simple_write_to_buffer".
Write a zero termination afterwards.

Signed-off-by: Markus Burri <markus.bu...@mt.com>
---
 drivers/gpio/gpio-virtuser.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-virtuser.c b/drivers/gpio/gpio-virtuser.c
index 13407fd4f0eb..9f3c491f5af1 100644
--- a/drivers/gpio/gpio-virtuser.c
+++ b/drivers/gpio/gpio-virtuser.c
@@ -401,10 +401,15 @@ static ssize_t gpio_virtuser_direction_do_write(struct 
file *file,
        char buf[32], *trimmed;
        int ret, dir, val = 0;
 
-       ret = simple_write_to_buffer(buf, sizeof(buf), ppos, user_buf, count);
+       if (size >= sizeof(buf))
+               return -EINVAL;
+
+       ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, 
count);
        if (ret < 0)
                return ret;
 
+       buf[ret] = '\0';
+
        trimmed = strim(buf);
 
        if (strcmp(trimmed, "input") == 0) {
@@ -623,12 +628,15 @@ static ssize_t gpio_virtuser_consumer_write(struct file 
*file,
        char buf[GPIO_VIRTUSER_NAME_BUF_LEN + 2];
        int ret;
 
+       if (count >= sizeof(buf))
+               return -EINVAL;
+
        ret = simple_write_to_buffer(buf, GPIO_VIRTUSER_NAME_BUF_LEN, ppos,
                                     user_buf, count);
        if (ret < 0)
                return ret;
 
-       buf[strlen(buf) - 1] = '\0';
+       buf[ret] = '\0';
 
        ret = gpiod_set_consumer_name(data->ad.desc, buf);
        if (ret)
-- 
2.39.5