diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-07 17:23:00 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-07 17:23:00 +0200 |
| commit | dcf5b8a7ae4e3875878529597c05f8cac4121515 (patch) | |
| tree | 0d86567a8feacb35b2a62c1ba6cf6c2fe3be65de /drivers/hid/hid-picolcd_debugfs.c | |
| parent | 864c971e923f55d3ff5ac3ebc87aab8108d30c8a (diff) | |
| parent | 7cfc41f8e80f11ffa8382ed1a505154ceffb79c7 (diff) | |
Merge v6.18.50linux-rolling-lts
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/hid/hid-picolcd_debugfs.c')
| -rw-r--r-- | drivers/hid/hid-picolcd_debugfs.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/hid/hid-picolcd_debugfs.c b/drivers/hid/hid-picolcd_debugfs.c index d01176da8896..0d325d69e64b 100644 --- a/drivers/hid/hid-picolcd_debugfs.c +++ b/drivers/hid/hid-picolcd_debugfs.c @@ -98,6 +98,15 @@ static ssize_t picolcd_debug_eeprom_read(struct file *f, char __user *u, ret = resp->raw_data[2]; if (ret > s) ret = s; + /* + * raw_data[2] is a device-supplied length; also clamp it to + * what picolcd_raw_event() actually stored (raw_size), or a + * hostile device overruns the raw_data[] buffer. + */ + if (ret > resp->raw_size - 3) + ret = resp->raw_size - 3; + if (ret < 0) + ret = 0; if (copy_to_user(u, resp->raw_data+3, ret)) ret = -EFAULT; else |