Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ebcbb527 authored by Vijayavardhan Vennapusa's avatar Vijayavardhan Vennapusa Committed by Gerrit - the friendly Code Review server
Browse files

dwc3: debugfs: Add check for length before copy data from userspace 



Add boundary check before copying data from userspace buffer to dwc3
local buffer. The third parameter passed to copy_from_user() should be
minimum of the two values between userpsace buffer size count and
(local_buffer size - 1). The last one byte in local_buffer should be
reserved for null terminator.

Change-Id: I9b2e3db4d5ad6b5f14515cadafa6264f9e8b786c
Signed-off-by: default avatarVijayavardhan Vennapusa <vvreddy@codeaurora.org>
parent bbc253a3

drivers/usb/dwc3/debugfs.c

+1 −1
Original line number Diff line number Diff line
@@ -634,7 +634,7 @@ static ssize_t dwc3_store_ep_num(struct file *file, const char __user *ubuf, 
	unsigned int		num, dir, temp;

	unsigned long		flags;



	if (copy_from_user(kbuf, ubuf, count > 10 ? 10 : count))

	if (copy_from_user(kbuf, ubuf, min_t(size_t, sizeof(kbuf) - 1, count)))

		return -EFAULT;



	if (sscanf(kbuf, "%u %u", &num, &dir) != 2)