diff options
| author | Jiri Kosina <jkosina@suse.com> | 2026-08-03 22:02:09 +0200 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.com> | 2026-08-03 22:02:09 +0200 |
| commit | ff02efb2b3c402dbcddf2eb7e0b3349854ec8027 (patch) | |
| tree | 4e7fd6084899c521a002cd89053ccad525e61ace | |
| parent | c183123ef17d7291f23109dc3de7e29467b63df7 (diff) | |
| parent | e9c667395ac1f8024f623250b32bae4c7af9caa0 (diff) | |
| download | linux-next-ff02efb2b3c402dbcddf2eb7e0b3349854ec8027.tar.gz linux-next-ff02efb2b3c402dbcddf2eb7e0b3349854ec8027.zip | |
Merge branch 'for-7.2/upstream-fixes' into for-next
| -rw-r--r-- | drivers/hid/hid-picolcd_debugfs.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/hid/hid-picolcd_debugfs.c b/drivers/hid/hid-picolcd_debugfs.c index 085847a92e07..1f7dfe60e9ba 100644 --- a/drivers/hid/hid-picolcd_debugfs.c +++ b/drivers/hid/hid-picolcd_debugfs.c @@ -99,6 +99,15 @@ static ssize_t picolcd_debug_eeprom_read(struct file *f, char __user *u, ret = resp->raw_data[2]; if (ret > s) ret = s; + /* + * raw_data[2] is a device-supplied length; also clamp it to + * what picolcd_raw_event() actually stored (raw_size), or a + * hostile device overruns the raw_data[] buffer. + */ + if (ret > resp->raw_size - 3) + ret = resp->raw_size - 3; + if (ret < 0) + ret = 0; if (copy_to_user(u, resp->raw_data+3, ret)) ret = -EFAULT; else |