diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2018-04-05 18:47:21 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-04-05 18:47:21 -0700 |
| commit | fa6082745d00c802c0ca8870dae4d7b0a3c2222b (patch) | |
| tree | aa0a23357a00378838864dfd08a565b066fd46db | |
| parent | 8dc67c0f98216609af0d215642c3cf2b9afbb58d (diff) | |
| parent | d24de74649b3e993556e76f84f219913731dd80c (diff) | |
Merge "fbdev: msm: check buffer size before writing to user buffer"
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_debug_xlog.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/video/fbdev/msm/mdss_debug_xlog.c b/drivers/video/fbdev/msm/mdss_debug_xlog.c index aeefc81657b0..10d747962a91 100644 --- a/drivers/video/fbdev/msm/mdss_debug_xlog.c +++ b/drivers/video/fbdev/msm/mdss_debug_xlog.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2018, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -755,6 +755,11 @@ static ssize_t mdss_xlog_dump_read(struct file *file, char __user *buff, if (__mdss_xlog_dump_calc_range()) { len = mdss_xlog_dump_entry(xlog_buf, MDSS_XLOG_BUF_MAX); + if (len < 0 || len > count) { + pr_err("len is more than the size of user buffer\n"); + return 0; + } + if (copy_to_user(buff, xlog_buf, len)) return -EFAULT; *ppos += len; |