mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 22:54:01 +00:00
PARISC: led.c - fix potential stack overflow in led_proc_write()
avoid potential stack overflow by correctly checking count parameter Reported-by: Ilja <ilja@netric.org> Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Kyle McMartin <kyle@mcmartin.ca> Cc: James E.J. Bottomley <jejb@parisc-linux.org> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
9fe6206f40
commit
4b4fd27c0b
1 changed files with 4 additions and 2 deletions
|
@ -176,16 +176,18 @@ static ssize_t led_proc_write(struct file *file, const char *buf,
|
||||||
size_t count, loff_t *pos)
|
size_t count, loff_t *pos)
|
||||||
{
|
{
|
||||||
void *data = PDE(file->f_path.dentry->d_inode)->data;
|
void *data = PDE(file->f_path.dentry->d_inode)->data;
|
||||||
char *cur, lbuf[count + 1];
|
char *cur, lbuf[32];
|
||||||
int d;
|
int d;
|
||||||
|
|
||||||
if (!capable(CAP_SYS_ADMIN))
|
if (!capable(CAP_SYS_ADMIN))
|
||||||
return -EACCES;
|
return -EACCES;
|
||||||
|
|
||||||
memset(lbuf, 0, count + 1);
|
if (count >= sizeof(lbuf))
|
||||||
|
count = sizeof(lbuf)-1;
|
||||||
|
|
||||||
if (copy_from_user(lbuf, buf, count))
|
if (copy_from_user(lbuf, buf, count))
|
||||||
return -EFAULT;
|
return -EFAULT;
|
||||||
|
lbuf[count] = 0;
|
||||||
|
|
||||||
cur = lbuf;
|
cur = lbuf;
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue