diff options
| author | Sami Tolvanen <samitolvanen@google.com> | 2017-02-15 14:55:26 -0800 |
|---|---|---|
| committer | Dmitry Shmidt <dimitrysh@google.com> | 2017-02-15 16:00:53 -0800 |
| commit | b9905d7e4fdda372f0fd45614c4a7c30f2273d57 (patch) | |
| tree | ed81bca050f2164785d3a81bb54613b8dc09105b | |
| parent | fdf73f5a33eeedfc4370e005a73f48c79a257a8f (diff) | |
ti-st: tty_hci: fix user space access
Use copy_to_user in hci_tty_ioctl.
Change-Id: I0d95936ca2ebee9ea53df9937bae9e33c6c93b01
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
| -rw-r--r-- | drivers/misc/ti-st/tty_hci.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/misc/ti-st/tty_hci.c b/drivers/misc/ti-st/tty_hci.c index ab227c20ee57..1f0986ae36d5 100644 --- a/drivers/misc/ti-st/tty_hci.c +++ b/drivers/misc/ti-st/tty_hci.c @@ -392,6 +392,7 @@ static long hci_tty_ioctl(struct file *file, struct sk_buff *skb = NULL; int retcode = 0; struct ti_st *hst; + unsigned int value = 0; pr_debug("inside %s (%p, %u, %lx)", __func__, file, cmd, arg); @@ -412,13 +413,13 @@ static long hci_tty_ioctl(struct file *file, */ skb = skb_dequeue(&hst->rx_list); if (skb != NULL) { - *(unsigned int *)arg = skb->len + 1; + value = skb->len + 1; /* Re-Store the SKB for furtur Read operations */ skb_queue_head(&hst->rx_list, skb); - } else { - *(unsigned int *)arg = 0; } - pr_debug("returning %d\n", *(unsigned int *)arg); + pr_debug("returning %d\n", value); + if (copy_to_user((void __user *)arg, &value, sizeof(value))) + return -EFAULT; break; default: pr_debug("Un-Identified IOCTL %d", cmd); |