diff options
| author | Michael Buesch <mb@bu3sch.de> | 2009-08-01 12:04:19 -0300 |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2009-08-01 23:50:40 -0400 |
| commit | 5b05d4696d38c3172e79e855cc1e2ed044589508 (patch) | |
| tree | 63a23cbb029bd0cac3e7b4f4863f996664afbd26 /drivers/platform | |
| parent | 1f6fc2de9525e34ee93bd392fa046369a8cfbf1e (diff) | |
| download | op-kernel-dev-5b05d4696d38c3172e79e855cc1e2ed044589508.zip op-kernel-dev-5b05d4696d38c3172e79e855cc1e2ed044589508.tar.gz | |
thinkpad-acpi: restrict procfs count value to sane upper limit
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers/platform')
| -rw-r--r-- | drivers/platform/x86/thinkpad_acpi.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c index 27d68e7..18f9ee6 100644 --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c @@ -766,6 +766,8 @@ static int dispatch_procfs_write(struct file *file, if (!ibm || !ibm->write) return -EINVAL; + if (count > PAGE_SIZE - 2) + return -EINVAL; kernbuf = kmalloc(count + 2, GFP_KERNEL); if (!kernbuf) |
