diff options
| author | Davi Arnaut <davi.arnaut@gmail.com> | 2006-02-01 03:06:40 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-02-01 08:53:25 -0800 |
| commit | 172411f10c25bbd81b19f67566af6a7f549f46a9 (patch) | |
| tree | 1a4bf56e53fdc6ea51cc2a72957e0eee710a284f /drivers | |
| parent | 46d0d2c811c8e9dd5cffdc3a5c03d988eb5a2996 (diff) | |
[PATCH] ebcdic do_kdsk_ioctl off-by-one
Add a missing return check from strnlen_user and fixes a off-by-one when
terminating the string with zero.
Signed-off-by: Davi Arnaut <davi.arnaut@gmail.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/s390/char/keyboard.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c index 5bda2340a39..a317a123dab 100644 --- a/drivers/s390/char/keyboard.c +++ b/drivers/s390/char/keyboard.c @@ -440,7 +440,11 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs, return -EPERM; len = strnlen_user(u_kbs->kb_string, sizeof(u_kbs->kb_string) - 1); - p = kmalloc(len, GFP_KERNEL); + if (!len) + return -EFAULT; + if (len > sizeof(u_kbs->kb_string) - 1) + return -EINVAL; + p = kmalloc(len + 1, GFP_KERNEL); if (!p) return -ENOMEM; if (copy_from_user(p, u_kbs->kb_string, len)) { |