diff options
| author | Daniel Rosenberg <drosen@google.com> | 2018-07-02 16:59:37 -0700 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2018-10-03 04:10:08 +0100 |
| commit | e44ab03f41ba55e181f4ed64e546feac8f8e69dc (patch) | |
| tree | 2af7fe31500a41d8fe364203c71bdfc72e334a17 | |
| parent | 3141e0750231be243bd4cd0fa6eebeb6a1578537 (diff) | |
HID: debug: check length before copy_to_user()
commit 717adfdaf14704fd3ec7fa2c04520c0723247eac upstream.
If our length is greater than the size of the buffer, we
overflow the buffer
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/hid/hid-debug.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c index 8bf61d295ffd..7192fa1d2786 100644 --- a/drivers/hid/hid-debug.c +++ b/drivers/hid/hid-debug.c @@ -1150,6 +1150,8 @@ copy_rest: goto out; if (list->tail > list->head) { len = list->tail - list->head; + if (len > count) + len = count; if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) { ret = -EFAULT; @@ -1159,6 +1161,8 @@ copy_rest: list->head += len; } else { len = HID_DEBUG_BUFSIZE - list->head; + if (len > count) + len = count; if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) { ret = -EFAULT; @@ -1166,7 +1170,9 @@ copy_rest: } list->head = 0; ret += len; - goto copy_rest; + count -= len; + if (count > 0) + goto copy_rest; } } |