From 172411f10c25bbd81b19f67566af6a7f549f46a9 Mon Sep 17 00:00:00 2001 From: Davi Arnaut Date: Wed, 1 Feb 2006 03:06:40 -0800 Subject: [PATCH] [PATCH] ebcdic do_kdsk_ioctl off-by-one Add a missing return check from strnlen_user and fixes a off-by-one when terminating the string with zero. Signed-off-by: Davi Arnaut Cc: Heiko Carstens Cc: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/s390/char/keyboard.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c index 5bda2340a3..a317a123da 100644 --- a/drivers/s390/char/keyboard.c +++ b/drivers/s390/char/keyboard.c @@ -440,7 +440,11 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs, return -EPERM; len = strnlen_user(u_kbs->kb_string, sizeof(u_kbs->kb_string) - 1); - p = kmalloc(len, GFP_KERNEL); + if (!len) + return -EFAULT; + if (len > sizeof(u_kbs->kb_string) - 1) + return -EINVAL; + p = kmalloc(len + 1, GFP_KERNEL); if (!p) return -ENOMEM; if (copy_from_user(p, u_kbs->kb_string, len)) { -- 2.39.5