diff options
| author | Anton Altaparmakov <aia21@cantab.net> | 2006-02-24 09:06:36 +0000 |
|---|---|---|
| committer | Anton Altaparmakov <aia21@cantab.net> | 2006-02-24 09:06:36 +0000 |
| commit | fab8d6ddf6dee2608869005d45fe97f70e4f5bdd (patch) | |
| tree | fecf566e03a87b2a44c7f3363ddb5c0d4bebdca7 /drivers/s390/char/keyboard.c | |
| parent | 64419d93a5906600af5817ad0cae3c6ecf7fb389 (diff) | |
| parent | f52ee1410d563cd409b08822492273a5bc235821 (diff) | |
| download | op-kernel-dev-fab8d6ddf6dee2608869005d45fe97f70e4f5bdd.zip op-kernel-dev-fab8d6ddf6dee2608869005d45fe97f70e4f5bdd.tar.gz | |
Merge branch 'master' of /home/src/linux-2.6/
Diffstat (limited to 'drivers/s390/char/keyboard.c')
| -rw-r--r-- | drivers/s390/char/keyboard.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c index 5bda234..a317a12 100644 --- a/drivers/s390/char/keyboard.c +++ b/drivers/s390/char/keyboard.c @@ -440,7 +440,11 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs, return -EPERM; len = strnlen_user(u_kbs->kb_string, sizeof(u_kbs->kb_string) - 1); - p = kmalloc(len, GFP_KERNEL); + if (!len) + return -EFAULT; + if (len > sizeof(u_kbs->kb_string) - 1) + return -EINVAL; + p = kmalloc(len + 1, GFP_KERNEL); if (!p) return -ENOMEM; if (copy_from_user(p, u_kbs->kb_string, len)) { |
