HID: debug: check length before copy_to_user()
commitf7e1dd8ebca4d67411c333223e4205879d141eaa
authorDaniel Rosenberg <drosen@google.com>
Mon, 2 Jul 2018 23:59:37 +0000 (2 16:59 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 11 Jul 2018 13:42:25 +0000 (11 15:42 +0200)
treea6beaeb39b8ed3c9d9e2ff738ac06408d958dc1f
parent5fe18b3dd7f5fd1fea2e92ed871460903ae60438
HID: debug: check length before copy_to_user()

commit 717adfdaf14704fd3ec7fa2c04520c0723247eac upstream.

If our length is greater than the size of the buffer, we
overflow the buffer

Cc: stable@vger.kernel.org
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/hid/hid-debug.c