Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'chrome-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/olof/chrome-platform
Pull chrome platform fix from Olof Johansson:
"A single fix this time, closing a window where ioctl args are fetched
twice"
* tag 'chrome-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/olof/chrome-platform:
platform/chrome: cros_ec_dev - double fetch bug in ioctl
+7
-1
+7
-1
drivers/platform/chrome/cros_ec_dev.c
+7
-1
drivers/platform/chrome/cros_ec_dev.c
···
151
151
goto exit;
152
152
}
153
153
154
+
if (u_cmd.outsize != s_cmd->outsize ||
155
+
u_cmd.insize != s_cmd->insize) {
156
+
ret = -EINVAL;
157
+
goto exit;
158
+
}
159
+
154
160
s_cmd->command += ec->cmd_offset;
155
161
ret = cros_ec_cmd_xfer(ec->ec_dev, s_cmd);
156
162
/* Only copy data to userland if data was received. */
157
163
if (ret < 0)
158
164
goto exit;
159
165
160
-
if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + u_cmd.insize))
166
+
if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize))
161
167
ret = -EFAULT;
162
168
exit:
163
169
kfree(s_cmd);