Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a604e6f3 authored by Zhen Kong's avatar Zhen Kong Committed by Gerrit - the friendly Code Review server
Browse files

crypto: msm: check length before copying to buf in _debug_stats_read 



Make sure that `len` is not larger than `count` before copying data
to userspace `buf` in _debug_stats_read().

Change-Id: Iafb7cfa3828653f8c28183c812797c3d9a183da1
Signed-off-by: default avatarZhen Kong <zkong@codeaurora.org>
parent 8a12cad4

drivers/crypto/msm/ota_crypto.c

+3 −3
Original line number Diff line number Diff line 
/* Copyright (c) 2010-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -884,7 +884,7 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf, 
	int len;



	len = _disp_stats();



	if (len <= count)

		rc = simple_read_from_buffer((void __user *) buf, len,

			ppos, (void *) _debug_read_buf, len);

drivers/crypto/msm/qcedev.c

+2 −2
Original line number Diff line number Diff line
@@ -1987,9 +1987,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf, 


	len = _disp_stats(qcedev);



	if (len <= count)

		rc = simple_read_from_buffer((void __user *) buf, len,

			ppos, (void *) _debug_read_buf, len);



	return rc;

}

drivers/crypto/msm/qcrypto.c

+3 −3
Original line number Diff line number Diff line 
/* Qualcomm Crypto driver

 *

 * Copyright (c) 2010-2016, The Linux Foundation. All rights reserved.

 * Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -5742,9 +5742,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf, 


	len = _disp_stats(qcrypto);



	if (len <= count)

		rc = simple_read_from_buffer((void __user *) buf, len,

			ppos, (void *) _debug_read_buf, len);



	return rc;

}