From 9e11c9b2471bce985df4ab6743a071d577558887 Mon Sep 17 00:00:00 2001 From: Nirmal Abraham Date: Wed, 22 May 2019 10:09:34 +0530 Subject: [PATCH] drm/msm/dsi-staging: Add range check in debugfs_dump_info_read Add a check to make sure that the length of bytes copied to the destination buffer doesn't exceed the requested buffer length before calling the copy_to_user to avoid buffer overflow. Change-Id: Icd65b9be2791a8a487dfc8d7461aadce61de3f1b Signed-off-by: Nirmal Abraham --- drivers/gpu/drm/msm/dsi-staging/dsi_display.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/dsi-staging/dsi_display.c b/drivers/gpu/drm/msm/dsi-staging/dsi_display.c index 175603b85d49..cf6a5554c072 100644 --- a/drivers/gpu/drm/msm/dsi-staging/dsi_display.c +++ b/drivers/gpu/drm/msm/dsi-staging/dsi_display.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. + * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -98,6 +98,9 @@ static ssize_t debugfs_dump_info_read(struct file *file, "\tClock master = %s\n", display->ctrl[display->clk_master_idx].ctrl->name); + if (len > count) + len = count; + if (copy_to_user(buff, buf, len)) { kfree(buf); return -EFAULT;