diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2016-10-13 15:55:08 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-10-24 15:36:15 +0200 |
| commit | cf55902b9c306ed259eb57ff111a0c152620f4a6 (patch) | |
| tree | 52336fa644b83a8b467b9b64f1218f25be5f9920 /drivers/staging | |
| parent | 8b77eb97f7847d67129d5312596e953bd7946f48 (diff) | |
staging: android: ion: Fix error handling in ion_query_heaps()
If the copy_to_user() fails we should unlock and return directly without
updating "cnt". Also the return value should be -EFAULT instead of the
number of bytes remaining.
Fixes: 02b23803c6af ("staging: android: ion: Add ioctl to query available heaps")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/android/ion/ion.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c index 396ded52ab70..209a8f7ef02b 100644 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -1187,8 +1187,10 @@ int ion_query_heaps(struct ion_client *client, struct ion_heap_query *query) hdata.type = heap->type; hdata.heap_id = heap->id; - ret = copy_to_user(&buffer[cnt], - &hdata, sizeof(hdata)); + if (copy_to_user(&buffer[cnt], &hdata, sizeof(hdata))) { + ret = -EFAULT; + goto out; + } cnt++; if (cnt >= max_cnt) |