diff options
| author | Jeff Garzik <jgarzik@pobox.com> | 2006-02-09 04:29:00 -0500 |
|---|---|---|
| committer | Jeff Garzik <jgarzik@pobox.com> | 2006-02-09 04:29:00 -0500 |
| commit | 9caafa6c8686e319cf4d5f3757b3972c6c522b7c (patch) | |
| tree | b38979b835b5d22e681b175d0b98a3c7560d9c59 /drivers/s390/char/keyboard.c | |
| parent | 51e9f2ff83df6b1c81c5c44f4486c68ed87aa20e (diff) | |
| parent | cac0e8e8bb2e7a086643bdd00c41d900a79bb4fa (diff) | |
Merge branch 'upstream-fixes'
Diffstat (limited to 'drivers/s390/char/keyboard.c')
| -rw-r--r-- | drivers/s390/char/keyboard.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c index 5bda2340a39d..a317a123daba 100644 --- a/drivers/s390/char/keyboard.c +++ b/drivers/s390/char/keyboard.c @@ -440,7 +440,11 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs, return -EPERM; len = strnlen_user(u_kbs->kb_string, sizeof(u_kbs->kb_string) - 1); - p = kmalloc(len, GFP_KERNEL); + if (!len) + return -EFAULT; + if (len > sizeof(u_kbs->kb_string) - 1) + return -EINVAL; + p = kmalloc(len + 1, GFP_KERNEL); if (!p) return -ENOMEM; if (copy_from_user(p, u_kbs->kb_string, len)) { |