Skip to content

Commit

Permalink
firmware: check for file truncation on direct firmware loading
Browse files Browse the repository at this point in the history
When direct firmware loading is used we iterate over a list
of possible firmware paths and concatenate the desired firmware
name with each path and look for the file there. Should the
passed firmware name be too long we end up truncating the
file we want to look for, the search however is still done.
Add a check for truncation instead of looking for a
truncated firmware filename.

Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Ming Lei <ming.lei@canonical.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: David Howells <dhowells@redhat.com>
Cc: Kyle McMartin <kyle@kernel.org>
Signed-off-by: Luis R. Rodriguez <mcgrof@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Luis R. Rodriguez authored and Greg Kroah-Hartman committed May 24, 2015
1 parent f5727b0 commit 1ba4de1
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions drivers/base/firmware_class.c
Original file line number Diff line number Diff line change
Expand Up @@ -320,7 +320,7 @@ static int fw_read_file_contents(struct file *file, struct firmware_buf *fw_buf)
static int fw_get_filesystem_firmware(struct device *device,
struct firmware_buf *buf)
{
int i;
int i, len;
int rc = -ENOENT;
char *path;

Expand All @@ -335,7 +335,12 @@ static int fw_get_filesystem_firmware(struct device *device,
if (!fw_path[i][0])
continue;

snprintf(path, PATH_MAX, "%s/%s", fw_path[i], buf->fw_id);
len = snprintf(path, PATH_MAX, "%s/%s",
fw_path[i], buf->fw_id);
if (len >= PATH_MAX) {
rc = -ENAMETOOLONG;
break;
}

file = filp_open(path, O_RDONLY, 0);
if (IS_ERR(file))
Expand Down

0 comments on commit 1ba4de1

Please sign in to comment.