diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-01-10 12:27:01 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-01-10 12:27:01 -0800 |
| commit | 17f73896b6e5d4e1ef17fb9a49bb869b861f0daa (patch) | |
| tree | 41ffa3b1247a8ca2e0bc12feecb34745268fd09f | |
| parent | 0a8e939a4e57d86da88c9856cd266447fc45ea85 (diff) | |
| parent | 642effc4f67956ae381db16e511eac000044ed2d (diff) | |
Merge "msm: sps: add the checking of userspace input length"
| -rw-r--r-- | drivers/platform/msm/sps/sps.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/platform/msm/sps/sps.c b/drivers/platform/msm/sps/sps.c index eab0e47e7cd2..2f11c6dd7e05 100644 --- a/drivers/platform/msm/sps/sps.c +++ b/drivers/platform/msm/sps/sps.c @@ -131,9 +131,10 @@ static ssize_t sps_set_info(struct file *file, const char __user *buf, int i; u32 buf_size_kb = 0; u32 new_buf_size; + u32 size = sizeof(str) < count ? sizeof(str) : count; memset(str, 0, sizeof(str)); - missing = copy_from_user(str, buf, sizeof(str)); + missing = copy_from_user(str, buf, size); if (missing) return -EFAULT; @@ -221,9 +222,10 @@ static ssize_t sps_set_logging_option(struct file *file, const char __user *buf, char str[MAX_MSG_LEN]; int i; u8 option = 0; + u32 size = sizeof(str) < count ? sizeof(str) : count; memset(str, 0, sizeof(str)); - missing = copy_from_user(str, buf, sizeof(str)); + missing = copy_from_user(str, buf, size); if (missing) return -EFAULT; @@ -270,9 +272,10 @@ static ssize_t sps_set_bam_addr(struct file *file, const char __user *buf, struct sps_bam *bam; u32 num_pipes = 0; void *vir_addr; + u32 size = sizeof(str) < count ? sizeof(str) : count; memset(str, 0, sizeof(str)); - missing = copy_from_user(str, buf, sizeof(str)); + missing = copy_from_user(str, buf, size); if (missing) return -EFAULT; |