diff options
| author | Daniel Rosenberg <drosen@google.com> | 2018-07-02 16:59:37 -0700 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2018-07-03 11:54:40 +0200 |
| commit | 717adfdaf14704fd3ec7fa2c04520c0723247eac (patch) | |
| tree | 909cbc9aaa97298c6110292cfc06a883174fc611 | |
| parent | 8f732850df1b2b4d8d719f7e606dfb3050e7ea11 (diff) | |
| download | linux-717adfdaf14704fd3ec7fa2c04520c0723247eac.tar.bz2 | |
HID: debug: check length before copy_to_user()
If our length is greater than the size of the buffer, we
overflow the buffer
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| -rw-r--r-- | drivers/hid/hid-debug.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c index 4f4e7a08a07b..4db8e140f709 100644 --- a/drivers/hid/hid-debug.c +++ b/drivers/hid/hid-debug.c @@ -1154,6 +1154,8 @@ copy_rest: goto out; if (list->tail > list->head) { len = list->tail - list->head; + if (len > count) + len = count; if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) { ret = -EFAULT; @@ -1163,6 +1165,8 @@ copy_rest: list->head += len; } else { len = HID_DEBUG_BUFSIZE - list->head; + if (len > count) + len = count; if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) { ret = -EFAULT; @@ -1170,7 +1174,9 @@ copy_rest: } list->head = 0; ret += len; - goto copy_rest; + count -= len; + if (count > 0) + goto copy_rest; } } |