Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 00719fab authored by Javier Martinez Canillas's avatar Javier Martinez Canillas Committed by Greg Kroah-Hartman
Browse files

Staging: bcm: Check correct user provided length and fix error code returned



bcm driver copies a buffer length provided by userpace without checking it.

RxCntrlMsgBitMask is of type unsigned long so only makes sense to copy
sizeof(unsigned long) bytes.

Also, copy_from_user() returns the number of bytes that could not be copied.
The driver is returning that value as error code instead of -EFAULT.

This patch solves both issues.

Signed-off-by: default avatarJavier Martinez Canillas <martinez.javier@gmail.com>
Cc: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent c69ab1a2
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment