commit ceff035e414211ae8bd0e873028b13d6e37b4d20
author Ratheesh S P <c_rpappa@qti.qualcomm.com> Thu Jul 16 15:27:18 2015 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Fri Jul 17 11:41:38 2015 -0700
tree 42d4e122b3e2ac3fe9ba2266abdba8038e8250dd
parent 13a844b908dedb1b1ab9cbc21ec6fc289665129f

prima: Fix buffer overwrite problem in GETSCANCHANNELTIME

qcacld-2.0 to prima propagation

If (len + 1) is greater than priv_data.total_len then copy_to_user
results in writing more data than the buffer can hold.
Fix this by writing mininum of (len + 1) and priv_data.total_len.

Change-Id: I9b4e118a8e145efe2f54b87f46030e874de67750
CRs-Fixed: 865556

CORE/HDD/src/wlan_hdd_main.c

diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 98ba4c4..1a33bae 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -3140,7 +3140,8 @@
            /* value is interms of msec */
            len = scnprintf(extra, sizeof(extra), "%s %d",
                    "GETSCANCHANNELTIME", val);
-           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           len = VOS_MIN(priv_data.total_len, len + 1);
+           if (copy_to_user(priv_data.buf, &extra, len))
            {
                VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "%s: failed to copy data to user buffer", __func__);