diff options
| author | Michael Buesch | 2009-08-01 12:04:19 -0300 |
|---|---|---|
| committer | Len Brown | 2009-08-01 23:50:40 -0400 |
| commit | 5b05d4696d38c3172e79e855cc1e2ed044589508 (patch) | |
| tree | 63a23cbb029bd0cac3e7b4f4863f996664afbd26 | |
| parent | 1f6fc2de9525e34ee93bd392fa046369a8cfbf1e (diff) | |
thinkpad-acpi: restrict procfs count value to sane upper limit
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Len Brown <len.brown@intel.com>
| -rw-r--r-- | drivers/platform/x86/thinkpad_acpi.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c index 27d68e719e90..18f9ee63c50a 100644 --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c @@ -766,6 +766,8 @@ static int dispatch_procfs_write(struct file *file, if (!ibm || !ibm->write) return -EINVAL; + if (count > PAGE_SIZE - 2) + return -EINVAL; kernbuf = kmalloc(count + 2, GFP_KERNEL); if (!kernbuf) |