From 0ddcf3a6b44209e73fb21b3c53e258884ea90cef Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 9 Jun 2021 17:17:52 +0200 Subject: [PATCH] platform/x86: think-lmi: Avoid potential read before start of the buffer If length equals 0 then reading buf[length-1] will read before the start of the buffer. Avoid this by moving the length == 0 check up. Cc: Mark Pearson Reported-by: Dan Carpenter Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20210609151752.156902-2-hdegoede@redhat.com --- drivers/platform/x86/think-lmi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c index 4881de4e669d..7771c9359449 100644 --- a/drivers/platform/x86/think-lmi.c +++ b/drivers/platform/x86/think-lmi.c @@ -443,10 +443,13 @@ static ssize_t kbdlang_store(struct kobject *kobj, int length; length = strlen(buf); + if (!length) + return -EINVAL; + if (buf[length-1] == '\n') length--; - if (!length || (length >= TLMI_LANG_MAXLEN)) + if (length >= TLMI_LANG_MAXLEN) return -EINVAL; memcpy(setting->kbdlang, buf, length);