power: Fix coverity error

Properly null-terminate userspace input string. Otherwise, the subsequent
strsep() could continue off into arbitrary chunks of kmalloc() space
that aren't part of the original string buffer.

Change-Id: I3868dbcdd9df7e7172c001eb6bc41c605d48604b
Signed-off-by: Sai Gurrappadi <sgurrappadi@nvidia.com>
Reviewed-on: http://git-master/r/355578
Reviewed-by: Paul Walmsley <pwalmsley@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Diwakar Tundlam <dtundlam@nvidia.com>

diff --git a/kernel/power/qos.c b/kernel/power/qos.c
index 5071a11ae4053c1858208584024e007452c22a45..9f2b98b6b076731d7e4eb0e3e7a5402c2070221c 100644 (file)
--- a/kernel/power/qos.c
+++ b/kernel/power/qos.c
@@ -28,7 +28,7 @@
  *
  * Support added for bounded constraints by
  * Sai Gurrappadi <sgurrappadi@nvidia.com>
- * Copyright (c) 2013, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved.
  */
 
 /*#define DEBUG*/
@@ -1412,7 +1412,7 @@ static ssize_t pm_qos_bounded_write(struct file *filp, const char __user *buf,
        if (!count || count >= MAX_WRITE_BYTES)
                return -EINVAL;
 
-       input = kzalloc(count, GFP_KERNEL);
+       input = kzalloc(count + 1, GFP_KERNEL);
        tmp = input;
        if (!input)
                return -ENOMEM;
@@ -1421,6 +1421,7 @@ static ssize_t pm_qos_bounded_write(struct file *filp, const char __user *buf,
                kfree(tmp);
                return -EFAULT;
        }
+       input[count] = '\0';
        memset(&value, 0, sizeof(value));
        max_constraint = pm_qos_array[req->max_req.pm_qos_class]->constraints;
        min_constraint = pm_qos_array[req->min_req.pm_qos_class]->constraints;