Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8756624a authored by Saket Saurabh's avatar Saket Saurabh
Browse files

ehci-msm2: Add boundary check in echi driver 



This change adds boundary check before copying data from userspace
buffer to ehci local buffer.
The third parameter passed to copy_from_user() should be minimum of the two
values between userpsace buffer size count and (local_buffer size - 1). The
last one byte in local_buffer should be reserved for null terminator.

CRs-Fixed: 547910
Change-Id: Id3c5432aa3fae3ce9759056b5481b9f516df7764
Signed-off-by: default avatarSaket Saurabh <ssaurabh@codeaurora.org>
parent 27c6afde

drivers/usb/host/ehci-msm2.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -1059,7 +1059,7 @@ static ssize_t debug_write_phy_data(struct file *file, const char __user *buf, 




	memset(kbuf, 0, 10);

	memset(kbuf, 0, 10);





	if (copy_from_user(kbuf, buf, count > 10 ? 10 : count))

	if (copy_from_user(kbuf, buf, min_t(size_t, sizeof(kbuf) - 1, count)))

		return -EFAULT;

		return -EFAULT;





	if (sscanf(kbuf, "%x", &data) != 1)

	if (sscanf(kbuf, "%x", &data) != 1)
@@ -1084,7 +1084,7 @@ static ssize_t debug_phy_write_addr(struct file *file, const char __user *buf, 




	memset(kbuf, 0, 10);

	memset(kbuf, 0, 10);





	if (copy_from_user(kbuf, buf, count > 10 ? 10 : count))

	if (copy_from_user(kbuf, buf, min_t(size_t, sizeof(kbuf) - 1, count)))

		return -EFAULT;

		return -EFAULT;





	if (sscanf(kbuf, "%x", &temp) != 1)

	if (sscanf(kbuf, "%x", &temp) != 1)