diff options
| author |  David S. Miller <davem@davemloft.net>
| 2018-10-03 21:00:17 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net>
| 2018-10-03 21:00:17 -0700 |
| commit | 6f41617bf23a17d9cb7cc6ca8161534f05f80293 (patch) | |
| tree | 2844d8d197a61b0603e31f09613e3272635dd1cc /drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | |
| parent | Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirshe... (diff) | |
| parent | Merge gitolite.kernel.org:/pub/scm/linux/kernel/git/davem/net (diff) | |
| download | linux-6f41617bf23a17d9cb7cc6ca8161534f05f80293.tar.gz linux-6f41617bf23a17d9cb7cc6ca8161534f05f80293.tar.bz2 linux-6f41617bf23a17d9cb7cc6ca8161534f05f80293.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Minor conflict in net/core/rtnetlink.c, David Ahern's bug fix in 'net'
overlapped the renaming of a netlink attribute in net-next.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c')
| -rw-r--r-- | drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c index ef69273074ba..a3edb20ea4c3 100644 --- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c +++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c @@ -496,6 +496,9 @@ static int omapfb_memory_read(struct fb_info *fbi, if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size)) return -EFAULT; + if (mr->w > 4096 || mr->h > 4096) + return -EINVAL; + if (mr->w * mr->h * 3 > mr->buffer_size) return -EINVAL; @@ -509,7 +512,7 @@ static int omapfb_memory_read(struct fb_info *fbi, mr->x, mr->y, mr->w, mr->h); if (r > 0) { - if (copy_to_user(mr->buffer, buf, mr->buffer_size)) + if (copy_to_user(mr->buffer, buf, r)) r = -EFAULT; } |