diff options
| author | Ashish Garg <ashigarg@codeaurora.org> | 2017-07-03 22:23:53 +0530 |
|---|---|---|
| committer | Ashish Garg <ashigarg@codeaurora.org> | 2017-07-03 22:28:38 +0530 |
| commit | 738ad6d0cf76ebc6f42ef209951281a66d84f1e6 (patch) | |
| tree | 429e797977a8a8edffe1e0d09845cbac2175bf22 /kernel/locking/mutex-debug.c | |
| parent | bc399a65c4e048d98b6304272e32402bfca59dda (diff) | |
msm: mdss: information leak during buffer copy from userspace
While trying to write dsi commands from userspace, the user buffer
is copied using simple_write_to_buffer. If the number of bytes in
the user buffer is less than the destination buffer, the length was
set to the destination buffer length. Subsequently the buffer could
be read from userspace to dump a lot of uninitialized kernel heap
data. Update the destination buffer with the correct size of bytes
copied from the user buffer.
Change-Id: Ib28f3698655d25ad8103fc02199a1d214092e232
Signed-off-by: Ashish Garg <ashigarg@codeaurora.org>
Diffstat (limited to 'kernel/locking/mutex-debug.c')
0 files changed, 0 insertions, 0 deletions