Merge "msm: sps: add the checking of userspace input length" (bb1b9823) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/platform/msm/sps/sps.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -131,9 +131,10 @@ static ssize_t sps_set_info(struct file file, const char __user buf,
		int i;
		u32 buf_size_kb = 0;
		u32 new_buf_size;
		u32 size = sizeof(str) < count ? sizeof(str) : count;

		memset(str, 0, sizeof(str));
		missing = copy_from_user(str, buf, sizeof(str));
		missing = copy_from_user(str, buf, size);
		if (missing)
		return -EFAULT;

		@@ -221,9 +222,10 @@ static ssize_t sps_set_logging_option(struct file file, const char __user buf,
		char str[MAX_MSG_LEN];
		int i;
		u8 option = 0;
		u32 size = sizeof(str) < count ? sizeof(str) : count;

		memset(str, 0, sizeof(str));
		missing = copy_from_user(str, buf, sizeof(str));
		missing = copy_from_user(str, buf, size);
		if (missing)
		return -EFAULT;

		@@ -270,9 +272,10 @@ static ssize_t sps_set_bam_addr(struct file file, const char __user buf,
		struct sps_bam *bam;
		u32 num_pipes = 0;
		void *vir_addr;
		u32 size = sizeof(str) < count ? sizeof(str) : count;

		memset(str, 0, sizeof(str));
		missing = copy_from_user(str, buf, sizeof(str));
		missing = copy_from_user(str, buf, size);
		if (missing)
		return -EFAULT;