From 4145770b07eedb4e32a1a32076bce43e56e1c7d9 Mon Sep 17 00:00:00 2001 From: Prashant Singh Date: Tue, 27 Aug 2019 17:34:24 +0530 Subject: [PATCH] disp: msm: add length check for debugfs_ctrl Add check for length of debugfs_ctrl value before copying to user buffer invoked during read operation. Change-Id: I199110992921d0ae3791129fa0bf1e51dcca9107 Signed-off-by: Prashant Singh --- msm/sde_dbg.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/msm/sde_dbg.c b/msm/sde_dbg.c index db62f5c511..03187a7385 100644 --- a/msm/sde_dbg.c +++ b/msm/sde_dbg.c @@ -3675,6 +3675,9 @@ static ssize_t sde_dbg_ctrl_read(struct file *file, char __user *buff, pr_debug("%s: ctrl:0x%x len:0x%zx\n", __func__, sde_dbg_base.debugfs_ctrl, len); + if (len < 0 || len >= sizeof(buf)) + return 0; + if ((count < sizeof(buf)) || copy_to_user(buff, buf, len)) { pr_err("error copying the buffer! count:0x%zx\n", count); return -EFAULT;