fbdev/omapfb: fix omapfb_memory_read infoleak

OMAPFB_MEMORY_READ ioctl reads pixels from the LCD's memory and copies
them to a userspace buffer. The code has two issues:

- The user provided width and height could be large enough to overflow
  the calculations
- The copy_to_user() can copy uninitialized memory to the userspace,
  which might contain sensitive kernel information.

Fix these by limiting the width & height parameters, and only copying
the amount of data that we actually received from the LCD.

Signed-off-by: Tomi Valkeinen <[email protected]>
Reported-by: Jann Horn <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: Will Deacon <[email protected]>
Cc: Jann Horn <[email protected]>
Cc: Tony Lindgren <[email protected]>
Signed-off-by: Bartlomiej Zolnierkiewicz <[email protected]>

0 files changed, 0 insertions, 0 deletions