Merge "diag: Prevent possible out of bound copy to userspace" (193e986d) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/char/diag/diag_masks.c

+13 −3

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/* Copyright (c) 2008-2020, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2008-2021, The Linux Foundation. All rights reserved.
		*/

		#include <linux/slab.h>
		@@ -3120,8 +3120,13 @@ int diag_copy_to_user_msg_mask(char __user *buf, size_t count,
		return -EINVAL;
		}

		if ((count - (sizeof(int))) >=
		mask_info->update_buf_client_len) {
		err = copy_to_user(buf, mask_info->update_buf_client,
		mask_info->update_buf_client_len);
		} else {
		err = -EINVAL;
		}
		if (err) {
		pr_err("diag: In %s Unable to send msg masks to user space clients, err: %d\n",
		__func__, err);
		@@ -3147,8 +3152,13 @@ int diag_copy_to_user_log_mask(char __user *buf, size_t count,
		return -EINVAL;
		}

		if ((count - (sizeof(int))) >=
		mask_info->update_buf_client_len) {
		err = copy_to_user(buf, mask_info->update_buf_client,
		mask_info->update_buf_client_len);
		} else {
		err = -EINVAL;
		}
		if (err) {
		pr_err("diag: In %s Unable to send msg masks to user space clients, err: %d\n",
		__func__, err);