power: Fix coverity error
Sai Gurrappadi [Tue, 14 Jan 2014 18:26:22 +0000 (10:26 -0800)]
Properly null-terminate userspace input string. Otherwise, the subsequent
strsep() could continue off into arbitrary chunks of kmalloc() space
that aren't part of the original string buffer.

Change-Id: I3868dbcdd9df7e7172c001eb6bc41c605d48604b
Signed-off-by: Sai Gurrappadi <sgurrappadi@nvidia.com>
Reviewed-on: http://git-master/r/355578
Reviewed-by: Paul Walmsley <pwalmsley@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Diwakar Tundlam <dtundlam@nvidia.com>

kernel/power/qos.c

index 5071a11..9f2b98b 100644 (file)
@@ -28,7 +28,7 @@
  *
  * Support added for bounded constraints by
  * Sai Gurrappadi <sgurrappadi@nvidia.com>
- * Copyright (c) 2013, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved.
  */
 
 /*#define DEBUG*/
@@ -1412,7 +1412,7 @@ static ssize_t pm_qos_bounded_write(struct file *filp, const char __user *buf,
        if (!count || count >= MAX_WRITE_BYTES)
                return -EINVAL;
 
-       input = kzalloc(count, GFP_KERNEL);
+       input = kzalloc(count + 1, GFP_KERNEL);
        tmp = input;
        if (!input)
                return -ENOMEM;
@@ -1421,6 +1421,7 @@ static ssize_t pm_qos_bounded_write(struct file *filp, const char __user *buf,
                kfree(tmp);
                return -EFAULT;
        }
+       input[count] = '\0';
        memset(&value, 0, sizeof(value));
        max_constraint = pm_qos_array[req->max_req.pm_qos_class]->constraints;
        min_constraint = pm_qos_array[req->min_req.pm_qos_class]->constraints;