On 10/24/11 12:52, Lars-Peter Clausen wrote:
> Make sure that the userspace buffer is large enough to hold a iio_event_data
> struct before writing to it.
>
Good catch. Shall I tack this on the end of the two fixes sets I sent earlier?
> Signed-off-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
Acked-by: Jonathan Cameron <jic23@xxxxxxxxx>
> ---
> drivers/staging/iio/industrialio-core.c | 6 ++++--
> 1 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/staging/iio/industrialio-core.c b/drivers/staging/iio/industrialio-core.c
> index 74904f1..733e83a 100644
> --- a/drivers/staging/iio/industrialio-core.c
> +++ b/drivers/staging/iio/industrialio-core.c
> @@ -169,8 +169,11 @@ static ssize_t iio_event_chrdev_read(struct file *filep,
> {
> struct iio_event_interface *ev_int = filep->private_data;
> struct iio_detected_event_list *el;
> + size_t len = sizeof(el->ev);
> int ret;
> - size_t len;
> +
> + if (count < len)
> + return -EINVAL;
>
> mutex_lock(&ev_int->event_list_lock);
> if (list_empty(&ev_int->det_events)) {
> @@ -192,7 +195,6 @@ static ssize_t iio_event_chrdev_read(struct file *filep,
> el = list_first_entry(&ev_int->det_events,
> struct iio_detected_event_list,
> list);
> - len = sizeof el->ev;
> if (copy_to_user(buf, &(el->ev), len)) {
> ret = -EFAULT;
> goto error_mutex_unlock;
--
To unsubscribe from this list: send the line "unsubscribe linux-iio" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
