diff options
| author | Harsh Sahu <hsahu@codeaurora.org> | 2018-03-22 23:22:17 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-05-18 00:51:09 -0700 |
| commit | 31748cad9cd807f15967851677355bea88f50d2e (patch) | |
| tree | 7907d4d8ac30e877ca07ed87b6782fdb65040381 | |
| parent | 3a9f9cc5918e4e12ac28c01faa4ecba9a54609fb (diff) | |
drm/msm : check buffer size before writing to user buffer
Check the number of bytes to copy against the size of the
user buffer before copy to user to avoid buffer overflow.
Change-Id: Ida3f2470b8441010adc30312c12c6d75fdd6ccb8
Signed-off-by: Harsh Sahu <hsahu@codeaurora.org>
| -rw-r--r-- | drivers/gpu/drm/msm/sde_dbg.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/gpu/drm/msm/sde_dbg.c b/drivers/gpu/drm/msm/sde_dbg.c index c886950e5212..93c4c1e27b0d 100644 --- a/drivers/gpu/drm/msm/sde_dbg.c +++ b/drivers/gpu/drm/msm/sde_dbg.c @@ -1643,6 +1643,11 @@ static ssize_t sde_evtlog_dump_read(struct file *file, char __user *buff, len = sde_evtlog_dump_to_buffer(sde_dbg_base.evtlog, evtlog_buf, SDE_EVTLOG_BUF_MAX, true); + if (len < 0 || len > count) { + pr_err("len is more than user buffer size"); + return 0; + } + if (copy_to_user(buff, evtlog_buf, len)) return -EFAULT; *ppos += len; |