On 10/24/2011 01:55 PM, Jonathan Cameron wrote:
> On 10/24/11 12:52, Lars-Peter Clausen wrote:
>> Make sure that the userspace buffer is large enough to hold a iio_event_data
>> struct before writing to it.
>>
> Good catch. Shall I tack this on the end of the two fixes sets I sent earlier?
Fine with me. Thanks.
>> Signed-off-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
> Acked-by: Jonathan Cameron <jic23@xxxxxxxxx>
>> ---
>> drivers/staging/iio/industrialio-core.c | 6 ++++--
>> 1 files changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/staging/iio/industrialio-core.c b/drivers/staging/iio/industrialio-core.c
>> index 74904f1..733e83a 100644
>> --- a/drivers/staging/iio/industrialio-core.c
>> +++ b/drivers/staging/iio/industrialio-core.c
>> @@ -169,8 +169,11 @@ static ssize_t iio_event_chrdev_read(struct file *filep,
>> {
>> struct iio_event_interface *ev_int = filep->private_data;
>> struct iio_detected_event_list *el;
>> + size_t len = sizeof(el->ev);
>> int ret;
>> - size_t len;
>> +
>> + if (count < len)
>> + return -EINVAL;
>>
>> mutex_lock(&ev_int->event_list_lock);
>> if (list_empty(&ev_int->det_events)) {
>> @@ -192,7 +195,6 @@ static ssize_t iio_event_chrdev_read(struct file *filep,
>> el = list_first_entry(&ev_int->det_events,
>> struct iio_detected_event_list,
>> list);
>> - len = sizeof el->ev;
>> if (copy_to_user(buf, &(el->ev), len)) {
>> ret = -EFAULT;
>> goto error_mutex_unlock;
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-iio" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-iio" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
