diff options
| author | Dave Kleikamp <shaggy@austin.ibm.com> | 2006-03-14 17:05:45 -0600 |
|---|---|---|
| committer | Dave Kleikamp <shaggy@austin.ibm.com> | 2006-03-14 17:05:45 -0600 |
| commit | c5111f504d2a9b0d258d7c4752b4093523315989 (patch) | |
| tree | 6a52864aff79691689aea21cb0cb928327d5de5b /drivers/s390/char/keyboard.c | |
| parent | 69eb66d7da7dba2696281981347698e1693c2340 (diff) | |
| parent | a488edc914aa1d766a4e2c982b5ae03d5657ec1b (diff) | |
Merge with /home/shaggy/git/linus-clean/
Diffstat (limited to 'drivers/s390/char/keyboard.c')
| -rw-r--r-- | drivers/s390/char/keyboard.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c index 5bda2340a39..a317a123dab 100644 --- a/drivers/s390/char/keyboard.c +++ b/drivers/s390/char/keyboard.c @@ -440,7 +440,11 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs, return -EPERM; len = strnlen_user(u_kbs->kb_string, sizeof(u_kbs->kb_string) - 1); - p = kmalloc(len, GFP_KERNEL); + if (!len) + return -EFAULT; + if (len > sizeof(u_kbs->kb_string) - 1) + return -EINVAL; + p = kmalloc(len + 1, GFP_KERNEL); if (!p) return -ENOMEM; if (copy_from_user(p, u_kbs->kb_string, len)) { |