evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: sps: add the checking of userspace input length"

Browse source
This commit is contained in:
Linux Build Service Account 2017-01-10 12:27:01 -08:00 • committed by Gerrit - the friendly Code Review server
commit 17f73896b6
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/platform/msm/sps/sps.c
View file

@ -131,9 +131,10 @@ static ssize_t sps_set_info(struct file *file, const char __user *buf,
int i; int i;
u32 buf_size_kb = 0; u32 buf_size_kb = 0;
u32 new_buf_size; u32 new_buf_size;
u32 size = sizeof(str) < count ? sizeof(str) : count;
memset(str, 0, sizeof(str)); memset(str, 0, sizeof(str));
missing = copy_from_user(str, buf, sizeof(str)); missing = copy_from_user(str, buf, size);
if (missing) if (missing)
return -EFAULT; return -EFAULT;
@ -221,9 +222,10 @@ static ssize_t sps_set_logging_option(struct file *file, const char __user *buf,
char str[MAX_MSG_LEN]; char str[MAX_MSG_LEN];
int i; int i;
u8 option = 0; u8 option = 0;
u32 size = sizeof(str) < count ? sizeof(str) : count;
memset(str, 0, sizeof(str)); memset(str, 0, sizeof(str));
missing = copy_from_user(str, buf, sizeof(str)); missing = copy_from_user(str, buf, size);
if (missing) if (missing)
return -EFAULT; return -EFAULT;
@ -270,9 +272,10 @@ static ssize_t sps_set_bam_addr(struct file *file, const char __user *buf,
struct sps_bam *bam; struct sps_bam *bam;
u32 num_pipes = 0; u32 num_pipes = 0;
void *vir_addr; void *vir_addr;
u32 size = sizeof(str) < count ? sizeof(str) : count;
memset(str, 0, sizeof(str)); memset(str, 0, sizeof(str));
missing = copy_from_user(str, buf, sizeof(str)); missing = copy_from_user(str, buf, size);
if (missing) if (missing)
return -EFAULT; return -EFAULT;