diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-07-07 17:45:53 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-07-07 17:45:53 -0700 |
| commit | 719e5e16408f7ec39b73525714c2e99c56e1543c (patch) | |
| tree | 80670a6130e4ce4068a186dff78481021c247b08 | |
| parent | a142e886a7c7b331ef03c8e479114b39b829f6b4 (diff) | |
| parent | 738ad6d0cf76ebc6f42ef209951281a66d84f1e6 (diff) | |
Merge "msm: mdss: information leak during buffer copy from userspace"
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_dsi.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/video/fbdev/msm/mdss_dsi.c b/drivers/video/fbdev/msm/mdss_dsi.c index 82f6d4a123b5..4ac10ab494e5 100644 --- a/drivers/video/fbdev/msm/mdss_dsi.c +++ b/drivers/video/fbdev/msm/mdss_dsi.c @@ -909,10 +909,15 @@ static ssize_t mdss_dsi_cmd_write(struct file *file, const char __user *p, /* Writing in batches is possible */ ret = simple_write_to_buffer(string_buf, blen, ppos, p, count); + if (ret < 0) { + pr_err("%s: Failed to copy data\n", __func__); + mutex_unlock(&pcmds->dbg_mutex); + return -EINVAL; + } - string_buf[blen] = '\0'; + string_buf[ret] = '\0'; pcmds->string_buf = string_buf; - pcmds->sblen = blen; + pcmds->sblen = count; mutex_unlock(&pcmds->dbg_mutex); return ret; } |