projects
/
linux-2.6-block.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
5ba1278
)
tty/vt: check allocation size in con_set_unimap()
author
Denis Efremov
<efremov@linux.com>
Wed, 3 Jun 2020 10:28:04 +0000
(13:28 +0300)
committer
Greg Kroah-Hartman
<gregkh@linuxfoundation.org>
Wed, 24 Jun 2020 15:11:58 +0000
(17:11 +0200)
The vmemdup_user() function has no 2-factor argument form. Use array_size()
to check for the overflow.
Signed-off-by: Denis Efremov <efremov@linux.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link:
https://lore.kernel.org/r/20200603102804.2110817-1-efremov@linux.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/vt/consolemap.c
patch
|
blob
|
blame
|
history
diff --git
a/drivers/tty/vt/consolemap.c
b/drivers/tty/vt/consolemap.c
index c1be96bb3ecfb829ec4802e7f1116bb94837a84d..5947b54d92bec3295ee9dd1b3991783e565e68cf 100644
(file)
--- a/
drivers/tty/vt/consolemap.c
+++ b/
drivers/tty/vt/consolemap.c
@@
-542,7
+542,7
@@
int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list)
if (!ct)
return 0;
- unilist = vmemdup_user(list,
ct * sizeof(struct unipair
));
+ unilist = vmemdup_user(list,
array_size(sizeof(struct unipair), ct
));
if (IS_ERR(unilist))
return PTR_ERR(unilist);