diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-06-30 14:57:38 +0800 |
|---|---|---|
| committer | Krzysztof Kozlowski <krzk@kernel.org> | 2026-07-27 20:38:32 +0200 |
| commit | 73f46553fd74a1fc56eb2e6218ff3a4ea1de43b5 (patch) | |
| tree | c7e2f42676270b5da2b78fd5be288e88a68cdcb3 | |
| parent | 169ae5e65e5aaf213b6a578f6478a9fd2e523606 (diff) | |
| download | linux-next-73f46553fd74a1fc56eb2e6218ff3a4ea1de43b5.tar.gz linux-next-73f46553fd74a1fc56eb2e6218ff3a4ea1de43b5.zip | |
w1: validate slave string length before checking separator
w1_atoreg_num() checks buf[2] for the family/id separator before proving
the input contains that byte.
Require at least the family and separator prefix before checking the
separator.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/2026063007047999.4-ccfa108-0039-w1-validate-slave-string-le-pengpeng@iscas.ac.cn
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
| -rw-r--r-- | drivers/w1/w1.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c index 486f321eadc8..c16946642789 100644 --- a/drivers/w1/w1.c +++ b/drivers/w1/w1.c @@ -403,6 +403,11 @@ static int w1_atoreg_num(struct device *dev, const char *buf, size_t count, const char *error_msg = "bad slave string format, expecting " "ff-dddddddddddd\n"; + if (count < 3) { + dev_err(dev, "%s", error_msg); + return -EINVAL; + } + if (buf[2] != '-') { dev_err(dev, "%s", error_msg); return -EINVAL; |