diff options
| author | Bartosz Golaszewski <bartosz.golaszewski@linaro.org> | 2025-03-17 08:27:10 +0100 |
|---|---|---|
| committer | Bartosz Golaszewski <bartosz.golaszewski@linaro.org> | 2025-03-17 08:27:10 +0100 |
| commit | 496fa7462275fc118f342e2e880bf7309d675bfd (patch) | |
| tree | a0687740ed24af5e1eedc5fae2733a4b7c248153 /drivers/misc/ntsync.c | |
| parent | 240ba5b6df0fb14cc49577c25d75dd4a6290239a (diff) | |
| parent | 4701f33a10702d5fc577c32434eb62adde0a1ae1 (diff) | |
Merge tag 'v6.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next
Linux 6.14-rc7
Diffstat (limited to 'drivers/misc/ntsync.c')
| -rw-r--r-- | drivers/misc/ntsync.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/misc/ntsync.c b/drivers/misc/ntsync.c index 055395cde42b..999026a1ae04 100644 --- a/drivers/misc/ntsync.c +++ b/drivers/misc/ntsync.c @@ -873,6 +873,7 @@ static int setup_wait(struct ntsync_device *dev, { int fds[NTSYNC_MAX_WAIT_COUNT + 1]; const __u32 count = args->count; + size_t size = array_size(count, sizeof(fds[0])); struct ntsync_q *q; __u32 total_count; __u32 i, j; @@ -880,15 +881,14 @@ static int setup_wait(struct ntsync_device *dev, if (args->pad || (args->flags & ~NTSYNC_WAIT_REALTIME)) return -EINVAL; - if (args->count > NTSYNC_MAX_WAIT_COUNT) + if (size >= sizeof(fds)) return -EINVAL; total_count = count; if (args->alert) total_count++; - if (copy_from_user(fds, u64_to_user_ptr(args->objs), - array_size(count, sizeof(*fds)))) + if (copy_from_user(fds, u64_to_user_ptr(args->objs), size)) return -EFAULT; if (args->alert) fds[count] = args->alert; @@ -1208,6 +1208,7 @@ static struct miscdevice ntsync_misc = { .minor = MISC_DYNAMIC_MINOR, .name = NTSYNC_NAME, .fops = &ntsync_fops, + .mode = 0666, }; module_misc_device(ntsync_misc); |