samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disp: msm: sde: add check before buffer copy

Browse Source 
This change adds a check for the length of the buffer
before copying it to avoid a buffer overflow.

Change-Id: I9af9d422e0b3cf02c8d6662af3310337a9861a7a
Signed-off-by: Satya Rama Aditya Pinapala <psraditya30@codeaurora.org>
This commit is contained in:
Satya Rama Aditya Pinapala
2019-07-25 10:56:51 -07:00
parent a6bfb7fc1e
commit 2078f3dd2e
2 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
msm/sde/sde_connector.c
View File

@@ -1698,6 +1698,7 @@ static ssize_t _sde_debugfs_conn_cmd_tx_sts_read(struct file *file,
return 0; return 0;
} }
blen = min_t(size_t, MAX_CMD_PAYLOAD_SIZE, count);
if (copy_to_user(buf, buffer, blen)) { if (copy_to_user(buf, buffer, blen)) {
SDE_ERROR("copy to user buffer failed\n"); SDE_ERROR("copy to user buffer failed\n");
return -EFAULT; return -EFAULT;

2
msm/sde_rsc.c
View File

@@ -1102,6 +1102,7 @@ end:
if (blen <= 0) if (blen <= 0)
return 0; return 0;
blen = min_t(size_t, MAX_BUFFER_SIZE, count);
if (copy_to_user(buf, buffer, blen)) if (copy_to_user(buf, buffer, blen))
return -EFAULT; return -EFAULT;
@@ -1195,6 +1196,7 @@ end:
if (blen <= 0) if (blen <= 0)
return 0; return 0;
blen = min_t(size_t, MAX_BUFFER_SIZE, count);
if (copy_to_user(buf, buffer, blen)) if (copy_to_user(buf, buffer, blen))
return -EFAULT; return -EFAULT;