crypto: msm: check length before copying to buf in _debug_stats_read

Make sure that `len` is not larger than `count` before copying data to userspace `buf` in _debug_stats_read(). Change-Id: Iafb7cfa3828653f8c28183c812797c3d9a183da1 Signed-off-by: Zhen Kong <zkong@codeaurora.org>
andi34 · Jul 29, 2017 · ea8606e · ea8606e
1 parent 9a3f8e6
commit ea8606e
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 6 deletions.
diff --git a/drivers/crypto/msm/ota_crypto.c b/drivers/crypto/msm/ota_crypto.c
@@ -744,8 +744,8 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf,
 	int len;
 
 	len = _disp_stats();
-
-	rc = simple_read_from_buffer((void __user *) buf, len,
+	if (len <= count)
+		rc = simple_read_from_buffer((void __user *) buf, len,
 			ppos, (void *) _debug_read_buf, len);
 
 	return rc;

diff --git a/drivers/crypto/msm/qcedev.c b/drivers/crypto/msm/qcedev.c
@@ -2230,9 +2230,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf,
 
 	len = _disp_stats(qcedev);
 
-	rc = simple_read_from_buffer((void __user *) buf, len,
+	if (len <= count)
+		rc = simple_read_from_buffer((void __user *) buf, len,
 			ppos, (void *) _debug_read_buf, len);
-
 	return rc;
 }
 

diff --git a/drivers/crypto/msm/qcrypto.c b/drivers/crypto/msm/qcrypto.c
@@ -4918,9 +4918,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf,
 
 	len = _disp_stats(qcrypto);
 
-	rc = simple_read_from_buffer((void __user *) buf, len,
+	if (len <= count)
+		rc = simple_read_from_buffer((void __user *) buf, len,
 			ppos, (void *) _debug_read_buf, len);
-
 	return rc;
 }