Dan Carpenter 096cdc6f52 platform/chrome: cros_ec_dev - double fetch bug in ioctl ... We verify "u_cmd.outsize" and "u_cmd.insize" but we need to make sure that those values have not changed between the two copy_from_user() calls. Otherwise it could lead to a buffer overflow. Additionally, cros_ec_cmd_xfer() can set s_cmd->insize to a lower value. We should use the new smaller value so we don't copy too much data to the user. Reported-by: Pengfei Wang <wpengfeinudt@gmail.com> Fixes: a841178445 ('mfd: cros_ec: Use a zero-length array for command data') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Gwendal Grignou <gwendal@chromium.org> Cc: <stable@vger.kernel.org> # v4.2+ Signed-off-by: Olof Johansson <olof@lixom.net>		2016-07-05 14:01:52 -07:00
..
chrome	platform/chrome: cros_ec_dev - double fetch bug in ioctl	2016-07-05 14:01:52 -07:00
goldfish
mips
olpc
x86	platform/x86: Drop duplicate dependencies on X86	2016-06-08 13:21:37 -07:00
Kconfig
Makefile