evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

crypto: msm: check length before copying to buf in _debug_stats_read

Browse source 
Make sure that `len` is not larger than `count` before copying data
to userspace `buf` in _debug_stats_read().

Change-Id: Iafb7cfa3828653f8c28183c812797c3d9a183da1
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
This commit is contained in:
Zhen Kong 2017-01-31 12:07:10 -08:00 • committed by Gerrit - the friendly Code Review server
parent af883d4db0
commit 08a969c0e4
3 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/crypto/msm/ota_crypto.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2010-2014, The Linux Foundation. All rights reserved.
/* Copyright (c) 2010-2014,2017 The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -880,8 +880,8 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf,
int len;
len = _disp_stats();
rc = simple_read_from_buffer((void __user *) buf, len,
if (len <= count)
rc = simple_read_from_buffer((void __user *) buf, len,
ppos, (void *) _debug_read_buf, len);
return rc;

4
drivers/crypto/msm/qcedev.c
View file

@ -1987,9 +1987,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf,
len = _disp_stats(qcedev);
rc = simple_read_from_buffer((void __user *) buf, len,
if (len <= count)
rc = simple_read_from_buffer((void __user *) buf, len,
ppos, (void *) _debug_read_buf, len);
return rc;
}

6
drivers/crypto/msm/qcrypto.c
View file

@ -1,6 +1,6 @@
/* Qualcomm Crypto driver
*
* Copyright (c) 2010-2016, The Linux Foundation. All rights reserved.
* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -5419,9 +5419,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf,
len = _disp_stats(qcrypto);
rc = simple_read_from_buffer((void __user *) buf, len,
if (len <= count)
rc = simple_read_from_buffer((void __user *) buf, len,
ppos, (void *) _debug_read_buf, len);
return rc;
}