3.2.77-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Sasha Levin <sasha.levin@xxxxxxxxxx> commit 6b9140f39c2aaf76791197fbab0839c0e4af56e8 upstream. Writing 0 length data into test_power makes it access an invalid array location and kill the system. Fixes: f17ef9b2d ("power: Make test_power driver more dynamic.") Signed-off-by: Sasha Levin <sasha.levin@xxxxxxxxxx> Signed-off-by: Sebastian Reichel <sre@xxxxxxxxxx> Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx> --- drivers/power/test_power.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/power/test_power.c +++ b/drivers/power/test_power.c @@ -237,6 +237,8 @@ static int map_get_value(struct battery_ buf[MAX_KEYLENGTH-1] = '\0'; cr = strnlen(buf, MAX_KEYLENGTH) - 1; + if (cr < 0) + return def_val; if (buf[cr] == '\n') buf[cr] = '\0'; -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html