UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

s390/vmcp: fix uaccess check and avoid undefined behavior 

The vmcp device driver should return -EFAULT if get_user() fails, due
to an invalid user space address. In addition the buffer size value
from user space is passed unchecked to get_order(). The return value
of get_order(0) undefined.

Therefore explicitly test for zero before calling get_order() and also
return -EFAULT if get_user() fails.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
Heiko Carstens 2017-08-07 15:16:15 +02:00 committed by Martin Schwidefsky
parent 34ad7cdc1b
commit 267239cc10
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/s390/char/vmcp.c
View File

@ -150,7 +150,9 @@ static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
get_order(session->bufsize));
session->response=NULL;
temp = get_user(session->bufsize, argp);
if (get_order(session->bufsize) > 8) {
if (temp)
session->bufsize = PAGE_SIZE;
if (!session->bufsize || get_order(session->bufsize) > 8) {
session->bufsize = PAGE_SIZE;
temp = -EINVAL;
}