Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e998903 authored by raghavendra ambadas's avatar raghavendra ambadas Committed by Karthi kandasamy
Browse files

drm/msm/dsi-staging: Add length check before copying to user space 



Add a check to make sure that the length of bytes copied to
the destination buffer doesn't exceed the requested buffer
count before calling the copy_to_user to avoid buffer overflow.

Change-Id: Ice834a9e024b09f3b6041399ff55dec00e75b9ef
Signed-off-by: default avatarRaghavendra Ambadas <rambad@codeaurora.org>
parent ef2348d6

drivers/gpu/drm/msm/dsi-staging/dsi_ctrl.c

+5 −0
Original line number Diff line number Diff line
@@ -121,6 +121,9 @@ static ssize_t debugfs_state_info_read(struct file *file, 
			dsi_ctrl->clk_freq.pix_clk_rate,

			dsi_ctrl->clk_freq.esc_clk_rate);



	if (len > count)

		len = count;



	/* TODO: make sure that this does not exceed 4K */

	if (copy_to_user(buff, buf, len)) {

		kfree(buf);
@@ -176,6 +179,8 @@ static ssize_t debugfs_reg_dump_read(struct file *file, 
		return rc;

	}



	if (len > count)

		len = count;



	/* TODO: make sure that this does not exceed 4K */

	if (copy_to_user(buff, buf, len)) {