diff options
| author | Zhen Kong <zkong@codeaurora.org> | 2017-01-31 12:07:10 -0800 |
|---|---|---|
| committer | Joey Rizzoli <joey@lineageos.org> | 2017-06-14 22:11:40 +0200 |
| commit | 981fd7db6627097e74c5071d596b4672d6b7e38c (patch) | |
| tree | 538b57a7665194784a83f1851172aa32962f5377 | |
| parent | 85781424c1a3163742029ebaf36564aba8f5d974 (diff) | |
crypto: msm: check length before copying to buf in _debug_stats_read
Make sure that `len` is not larger than `count` before copying data
to userspace `buf` in _debug_stats_read().
Change-Id: Iafb7cfa3828653f8c28183c812797c3d9a183da1
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
| -rw-r--r-- | drivers/crypto/msm/ota_crypto.c | 4 | ||||
| -rw-r--r-- | drivers/crypto/msm/qcedev.c | 4 | ||||
| -rw-r--r-- | drivers/crypto/msm/qcrypto.c | 4 |
3 files changed, 6 insertions, 6 deletions
diff --git a/drivers/crypto/msm/ota_crypto.c b/drivers/crypto/msm/ota_crypto.c index 6ecf5b2b4cc..60525358f89 100644 --- a/drivers/crypto/msm/ota_crypto.c +++ b/drivers/crypto/msm/ota_crypto.c @@ -744,8 +744,8 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf, int len; len = _disp_stats(); - - rc = simple_read_from_buffer((void __user *) buf, len, + if (len <= count) + rc = simple_read_from_buffer((void __user *) buf, len, ppos, (void *) _debug_read_buf, len); return rc; diff --git a/drivers/crypto/msm/qcedev.c b/drivers/crypto/msm/qcedev.c index e87e5708ffd..43b3d0ad5d3 100644 --- a/drivers/crypto/msm/qcedev.c +++ b/drivers/crypto/msm/qcedev.c @@ -2173,9 +2173,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf, len = _disp_stats(qcedev); - rc = simple_read_from_buffer((void __user *) buf, len, + if (len <= count) + rc = simple_read_from_buffer((void __user *) buf, len, ppos, (void *) _debug_read_buf, len); - return rc; } diff --git a/drivers/crypto/msm/qcrypto.c b/drivers/crypto/msm/qcrypto.c index bbf4ef693ed..8d1c7e27e3b 100644 --- a/drivers/crypto/msm/qcrypto.c +++ b/drivers/crypto/msm/qcrypto.c @@ -4918,9 +4918,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf, len = _disp_stats(qcrypto); - rc = simple_read_from_buffer((void __user *) buf, len, + if (len <= count) + rc = simple_read_from_buffer((void __user *) buf, len, ppos, (void *) _debug_read_buf, len); - return rc; } |