diff options
| author | David Lin <dtwlin@google.com> | 2018-07-13 22:36:04 +0000 |
|---|---|---|
| committer | Android Partner Code Review <android-gerrit-partner@google.com> | 2018-07-13 22:36:04 +0000 |
| commit | d0caa6a27febd6319956b93e5b8d06e45fe5ccbc (patch) | |
| tree | 1b9a3565d16cd3057944f0f85a3dae9d63cb2f45 | |
| parent | f0205d71f86d40e0cd7003c2223a166d87095964 (diff) | |
| parent | 5ed14fbc1ae9991ea2c11c037c33451fc7957a39 (diff) | |
| download | tegra-android-tegra-dragon-3.18-oreo-m4.tar.gz | |
Merge "ANDROID: HID: debug: check length in hid_debug_events_read() before copy_to_user()" into android-chromeos-dragon-3.18android-8.1.0_r0.100android-tegra-dragon-3.18-oreo-m4
| -rw-r--r-- | drivers/hid/hid-debug.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c index 8bf61d295ffd..7192fa1d2786 100644 --- a/drivers/hid/hid-debug.c +++ b/drivers/hid/hid-debug.c @@ -1150,6 +1150,8 @@ copy_rest: goto out; if (list->tail > list->head) { len = list->tail - list->head; + if (len > count) + len = count; if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) { ret = -EFAULT; @@ -1159,6 +1161,8 @@ copy_rest: list->head += len; } else { len = HID_DEBUG_BUFSIZE - list->head; + if (len > count) + len = count; if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) { ret = -EFAULT; @@ -1166,7 +1170,9 @@ copy_rest: } list->head = 0; ret += len; - goto copy_rest; + count -= len; + if (count > 0) + goto copy_rest; } } |