From 21aed53e998a0e5beb4f36d07e8c5f950657922c Mon Sep 17 00:00:00 2001 From: Zongdong Jiao Date: Thu, 13 Sep 2018 10:17:34 +0800 Subject: [PATCH] hdmitx: fix KASAN Bug in set_disp_mode_auto [1/1] PD#173549: hdmitx: fix KASAN Bug in set_disp_mode_auto ================================================================== BUG: KASAN: global-out-of-bounds in set_disp_mode_auto+0x244/0x870 Read of size 32 at addr ffffff900a67e4c0 by task power@1.0-servi/2924 CPU: 2 PID: 2924 Comm: power@1.0-servi Tainted: G B O 4.9.113 #1 Hardware name: Amlogic (DT) Call trace: [] dump_backtrace+0x0/0x368 [] show_stack+0x24/0x30 [] dump_stack+0xa0/0xc8 [] print_address_description+0x144/0x258 [] kasan_report+0x264/0x338 [] check_memory_region+0x12c/0x1c0 [] __asan_loadN+0x14/0x20 [] set_disp_mode_auto+0x244/0x870 [] hdmitx_late_resume+0x1cc/0x288 [] early_suspend_trigger_store+0x1a8/0x1d0 [] kobj_attr_store+0x44/0x60 [] sysfs_kf_write+0x98/0xb8 [] kernfs_fop_write+0x12c/0x270 [] __vfs_write+0xd8/0x268 [] vfs_write+0xd8/0x240 [] SyS_write+0xc4/0x148 [] el0_svc_naked+0x34/0x38 The buggy address belongs to the variable: all_fmt_paras+0x1460/0x14a0 Memory state around the buggy address: ffffff900a67e380: 00 07 fa fa fa fa fa fa 00 02 fa fa fa fa fa fa ffffff900a67e400: 00 07 fa fa fa fa fa fa 00 02 fa fa fa fa fa fa >ffffff900a67e480: 00 07 fa fa fa fa fa fa 00 02 fa fa fa fa fa fa ^ ffffff900a67e500: 00 07 fa fa fa fa fa fa 00 03 fa fa fa fa fa fa ffffff900a67e580: 00 04 fa fa fa fa fa fa 00 04 fa fa fa fa fa fa ================================================================== Change-Id: Ie2435c031c04ac23e801cfefa80a29071c120b4f Signed-off-by: Zongdong Jiao --- drivers/amlogic/media/vout/hdmitx/hdmi_tx_20/hdmi_tx_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/amlogic/media/vout/hdmitx/hdmi_tx_20/hdmi_tx_main.c b/drivers/amlogic/media/vout/hdmitx/hdmi_tx_20/hdmi_tx_main.c index b56c31d..db37431 100644 --- a/drivers/amlogic/media/vout/hdmitx/hdmi_tx_20/hdmi_tx_main.c +++ b/drivers/amlogic/media/vout/hdmitx/hdmi_tx_20/hdmi_tx_main.c @@ -467,7 +467,7 @@ static int set_disp_mode_auto(void) hdev->para = hdmi_get_fmt_name("invalid", hdev->fmt_attr); return -1; } - memcpy(mode, info->name, sizeof(mode)); + strncpy(mode, info->name, sizeof(mode)); if (strstr(mode, "fp")) { int i = 0; -- 2.7.4