From: Sasha Levin sasha.levin@oracle.com
commit 6b9140f39c2aaf76791197fbab0839c0e4af56e8 upstream.
Writing 0 length data into test_power makes it access an invalid array location and kill the system.
Fixes: f17ef9b2d ("power: Make test_power driver more dynamic.") Signed-off-by: Sasha Levin sasha.levin@oracle.com Signed-off-by: Sebastian Reichel sre@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/power/test_power.c | 2 ++ 1 file changed, 2 insertions(+)
--- a/drivers/power/test_power.c +++ b/drivers/power/test_power.c @@ -301,6 +301,8 @@ static int map_get_value(struct battery_ buf[MAX_KEYLENGTH-1] = '\0';
cr = strnlen(buf, MAX_KEYLENGTH) - 1; + if (cr < 0) + return def_val; if (buf[cr] == '\n') buf[cr] = '\0';