diff options
| -rw-r--r-- | drivers/s390/char/keyboard.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c index 5bda2340a39d..a317a123daba 100644 --- a/drivers/s390/char/keyboard.c +++ b/drivers/s390/char/keyboard.c @@ -440,7 +440,11 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs, return -EPERM; len = strnlen_user(u_kbs->kb_string, sizeof(u_kbs->kb_string) - 1); - p = kmalloc(len, GFP_KERNEL); + if (!len) + return -EFAULT; + if (len > sizeof(u_kbs->kb_string) - 1) + return -EINVAL; + p = kmalloc(len + 1, GFP_KERNEL); if (!p) return -ENOMEM; if (copy_from_user(p, u_kbs->kb_string, len)) { |