From 8756624acb1e090b45baf07b2a8d0ebde114000e Mon Sep 17 00:00:00 2001 From: Saket Saurabh Date: Mon, 30 Sep 2013 17:33:57 +0530 Subject: ehci-msm2: Add boundary check in echi driver This change adds boundary check before copying data from userspace buffer to ehci local buffer. The third parameter passed to copy_from_user() should be minimum of the two values between userpsace buffer size count and (local_buffer size - 1). The last one byte in local_buffer should be reserved for null terminator. CRs-Fixed: 547910 Change-Id: Id3c5432aa3fae3ce9759056b5481b9f516df7764 Signed-off-by: Saket Saurabh --- drivers/usb/host/ehci-msm2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/ehci-msm2.c b/drivers/usb/host/ehci-msm2.c index 221af44..32ed806 100644 --- a/drivers/usb/host/ehci-msm2.c +++ b/drivers/usb/host/ehci-msm2.c @@ -1059,7 +1059,7 @@ static ssize_t debug_write_phy_data(struct file *file, const char __user *buf, memset(kbuf, 0, 10); - if (copy_from_user(kbuf, buf, count > 10 ? 10 : count)) + if (copy_from_user(kbuf, buf, min_t(size_t, sizeof(kbuf) - 1, count))) return -EFAULT; if (sscanf(kbuf, "%x", &data) != 1) @@ -1084,7 +1084,7 @@ static ssize_t debug_phy_write_addr(struct file *file, const char __user *buf, memset(kbuf, 0, 10); - if (copy_from_user(kbuf, buf, count > 10 ? 10 : count)) + if (copy_from_user(kbuf, buf, min_t(size_t, sizeof(kbuf) - 1, count))) return -EFAULT; if (sscanf(kbuf, "%x", &temp) != 1) -- cgit v1.1