| From 2ab68ec927310dc488f3403bb48f9e4ad00a9491 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sasha.levin@oracle.com> |
| Date: Tue, 19 Nov 2013 14:25:36 -0500 |
| Subject: video: kyro: fix incorrect sizes when copying to userspace |
| |
| From: Sasha Levin <sasha.levin@oracle.com> |
| |
| commit 2ab68ec927310dc488f3403bb48f9e4ad00a9491 upstream. |
| |
| kyro would copy u32s and specify sizeof(unsigned long) as the size to copy. |
| |
| This would copy more data than intended and cause memory corruption and might |
| leak kernel memory. |
| |
| Signed-off-by: Sasha Levin <sasha.levin@oracle.com> |
| Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/video/kyro/fbdev.c | 6 +++--- |
| 1 file changed, 3 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/video/kyro/fbdev.c |
| +++ b/drivers/video/kyro/fbdev.c |
| @@ -625,15 +625,15 @@ static int kyrofb_ioctl(struct fb_info * |
| } |
| break; |
| case KYRO_IOCTL_UVSTRIDE: |
| - if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long))) |
| + if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(deviceInfo.ulOverlayUVStride))) |
| return -EFAULT; |
| break; |
| case KYRO_IOCTL_STRIDE: |
| - if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long))) |
| + if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(deviceInfo.ulOverlayStride))) |
| return -EFAULT; |
| break; |
| case KYRO_IOCTL_OVERLAY_OFFSET: |
| - if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long))) |
| + if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(deviceInfo.ulOverlayOffset))) |
| return -EFAULT; |
| break; |
| } |