3.2.77-rc1 review patch. If anyone has any objections, please let me know.
------------------ From: Sasha Levin <[email protected]> commit 6b9140f39c2aaf76791197fbab0839c0e4af56e8 upstream. Writing 0 length data into test_power makes it access an invalid array location and kill the system. Fixes: f17ef9b2d ("power: Make test_power driver more dynamic.") Signed-off-by: Sasha Levin <[email protected]> Signed-off-by: Sebastian Reichel <[email protected]> Signed-off-by: Ben Hutchings <[email protected]> --- drivers/power/test_power.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/power/test_power.c +++ b/drivers/power/test_power.c @@ -237,6 +237,8 @@ static int map_get_value(struct battery_ buf[MAX_KEYLENGTH-1] = '\0'; cr = strnlen(buf, MAX_KEYLENGTH) - 1; + if (cr < 0) + return def_val; if (buf[cr] == '\n') buf[cr] = '\0';
