mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 10:49:33 +00:00
ACPI: Fix bound checks for copy_from_user in the acpi /proc code
The ACPI /proc write() code takes an unsigned length argument like any write() function, but then assigned it to a *signed* integer called "len". Only after this is a sanity check for len done to make it not larger than 4. Due to the type change a len < 0 is in principle also possible; this patch adds a check for this. Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
This commit is contained in:
parent
0efe5e32c8
commit
d9f6501806
1 changed files with 2 additions and 0 deletions
|
@ -398,6 +398,8 @@ acpi_system_write_wakeup_device(struct file *file,
|
|||
|
||||
if (len > 4)
|
||||
len = 4;
|
||||
if (len < 0)
|
||||
return -EFAULT;
|
||||
|
||||
if (copy_from_user(strbuf, buffer, len))
|
||||
return -EFAULT;
|
||||
|
|
Loading…
Reference in a new issue