diff options
| author | Sai Gurrappadi <sgurrappadi@nvidia.com> | 2014-01-14 10:26:22 -0800 |
|---|---|---|
| committer | Diwakar Tundlam <dtundlam@nvidia.com> | 2014-01-14 15:21:50 -0800 |
| commit | eff22ca7c982a2e0d5591f0b442842e784efeb9c (patch) | |
| tree | bc8c0fa73f701fa6ec8b99921da340d1e26dc865 /kernel/power | |
| parent | ec109abaddec39c69f846962e2f57c932a2a0475 (diff) | |
power: Fix coverity error
Properly null-terminate userspace input string. Otherwise, the subsequent
strsep() could continue off into arbitrary chunks of kmalloc() space
that aren't part of the original string buffer.
Change-Id: I3868dbcdd9df7e7172c001eb6bc41c605d48604b
Signed-off-by: Sai Gurrappadi <sgurrappadi@nvidia.com>
Reviewed-on: http://git-master/r/355578
Reviewed-by: Paul Walmsley <pwalmsley@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Diwakar Tundlam <dtundlam@nvidia.com>
Diffstat (limited to 'kernel/power')
| -rw-r--r-- | kernel/power/qos.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/kernel/power/qos.c b/kernel/power/qos.c index 5071a11ae405..9f2b98b6b076 100644 --- a/kernel/power/qos.c +++ b/kernel/power/qos.c @@ -28,7 +28,7 @@ * * Support added for bounded constraints by * Sai Gurrappadi <sgurrappadi@nvidia.com> - * Copyright (c) 2013, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved. */ /*#define DEBUG*/ @@ -1412,7 +1412,7 @@ static ssize_t pm_qos_bounded_write(struct file *filp, const char __user *buf, if (!count || count >= MAX_WRITE_BYTES) return -EINVAL; - input = kzalloc(count, GFP_KERNEL); + input = kzalloc(count + 1, GFP_KERNEL); tmp = input; if (!input) return -ENOMEM; @@ -1421,6 +1421,7 @@ static ssize_t pm_qos_bounded_write(struct file *filp, const char __user *buf, kfree(tmp); return -EFAULT; } + input[count] = '\0'; memset(&value, 0, sizeof(value)); max_constraint = pm_qos_array[req->max_req.pm_qos_class]->constraints; min_constraint = pm_qos_array[req->min_req.pm_qos_class]->constraints; |