Arjan van de Ven
d9f6501806
ACPI: Fix bound checks for copy_from_user in the acpi /proc code ...
The ACPI /proc write() code takes an unsigned length argument like any write()
function, but then assigned it to a *signed* integer called "len".
Only after this is a sanity check for len done to make it not larger than 4.
Due to the type change a len < 0 is in principle also possible; this patch
adds a check for this.
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2009-10-03 00:59:12 -04:00
2009-09-23 09:32:11 -07:00
2009-08-28 19:57:27 -04:00
2009-09-19 01:56:39 -04:00
2009-09-19 01:56:17 -04:00
2009-09-19 00:37:13 -04:00
2009-09-25 14:24:30 -04:00
2009-09-24 10:30:41 -07:00
2009-08-28 19:57:27 -04:00
2009-09-19 01:45:22 -04:00
2009-09-19 01:38:57 -04:00
2009-09-19 01:45:22 -04:00
2009-09-19 02:14:45 -04:00
2009-08-28 19:57:27 -04:00
2009-08-28 19:57:27 -04:00
2009-09-19 01:45:22 -04:00
2009-08-28 19:57:27 -04:00
2009-09-19 02:10:40 -04:00
2009-09-19 01:30:01 -04:00
2009-08-28 19:57:27 -04:00
2009-09-27 03:12:13 -04:00
2009-06-17 23:32:23 -04:00
2009-08-28 19:57:27 -04:00
2009-08-28 19:57:27 -04:00
2009-09-19 00:37:13 -04:00
2009-09-19 02:14:45 -04:00
2009-09-19 01:30:01 -04:00
2009-09-19 00:37:13 -04:00
2009-10-03 00:59:12 -04:00
2009-09-19 02:10:40 -04:00
2009-09-27 11:58:36 -07:00
2009-09-24 09:34:24 +09:30
2009-09-19 02:10:40 -04:00
2009-09-24 09:34:24 +09:30
2008-12-31 01:15:00 -05:00
2009-08-28 19:57:27 -04:00
2009-08-28 19:57:27 -04:00
2007-12-14 15:14:06 -05:00
2009-09-25 15:09:49 -04:00
2009-09-19 00:06:59 -04:00
2009-04-07 00:02:40 -04:00
2009-08-28 19:57:27 -04:00
2009-08-28 19:57:28 -04:00
2009-08-28 19:57:27 -04:00
2009-08-28 19:57:27 -04:00
2009-08-28 19:57:27 -04:00
2009-10-01 16:11:11 -07:00
2009-09-09 14:19:18 -07:00
d9f6501806