diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-01-09 07:09:19 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-01-17 21:52:37 (GMT) |
| commit | cb9cc9cae9ebde1148e48c9682205af8518ec0c9 (patch) | |
| tree | 2d273b84555f071223586dc7b55de3c428c15eb9 | |
| parent | b3d07cf5a1045130057ebf39282092c31ceca185 (diff) | |
| download | linux-fsl-qoriq-cb9cc9cae9ebde1148e48c9682205af8518ec0c9.tar.xz | |
Staging: bcm: copying more data than intended
This was changed to bcm_flash2x_cs_info instead of bcm_flash_cs_info
when we got rid of the typedefs. bcm_flash2x_cs_info is quite a bit
larger than bcm_flash_cs_info (436 bytes instead of 96) so it would
corrupt user memory and it's an info leak.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/bcm/Bcmchar.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c index 4ba1a5d..491e2bf 100644 --- a/drivers/staging/bcm/Bcmchar.c +++ b/drivers/staging/bcm/Bcmchar.c @@ -1792,7 +1792,7 @@ cntrlEnd: if (IoBuffer.OutputLength < sizeof(struct bcm_flash_cs_info)) return -EINVAL; - if (copy_to_user(IoBuffer.OutputBuffer, Adapter->psFlashCSInfo, sizeof(struct bcm_flash2x_cs_info))) + if (copy_to_user(IoBuffer.OutputBuffer, Adapter->psFlashCSInfo, sizeof(struct bcm_flash_cs_info))) return -EFAULT; } } |