Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote: > The problem with this copy_to_user() calls is that they don't ensure > that "size" is less than the "length" which the user provided. > > Obviously, this is debugfs and "size" is normally going to be very small > so it probably doesn't matter, but this is the correct thing to do. > > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> > Acked-by: Stanislaw Gruszka <sgruszka@xxxxxxxxxx> Patch applied to wireless-drivers-next.git, thanks. f483039cf51a rt2x00: use simple_read_from_buffer() -- https://patchwork.kernel.org/patch/10572845/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
