lkml.org 
[lkml]   [2016]   [Oct]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 42/51] s390/con3270: fix use of uninitialised data
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Sascha Silbe <silbe@linux.vnet.ibm.com>

    commit c14f2aac7aa147861793eed9f41f91dd530f0be1 upstream.

    con3270 contains an optimisation that reduces the amount of data to be
    transmitted to the 3270 terminal by putting a Repeat to Address (RA)
    order into the data stream. The RA order itself takes up space, so
    con3270 only uses it if there's enough space left in the line
    buffer. Otherwise it just pads out the line manually.

    For lines too long to include the RA order, one byte was left
    uninitialised. This was caused by an off-by-one bug in the loop that
    pads out the line. Since the buffer is allocated from a common pool,
    the single byte left uninitialised contained some previous buffer
    content. Usually this was just a space or some character (which can
    result in clutter but is otherwise harmless). Sometimes, however, it
    was a Repeat to Address order, messing up the entire screen layout and
    causing the display to send the entire buffer content on every
    keystroke.

    Fixes: f51320a5 ("[PATCH] s390: new 3270 driver.") (tglx/history.git)
    Reported-by: Liu Jing <liujbjl@linux.vnet.ibm.com>
    Tested-by: Jing Liu <liujbjl@linux.vnet.ibm.com>
    Tested-by: Yang Chen <bjcyang@linux.vnet.ibm.com>
    Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/s390/char/con3270.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/s390/char/con3270.c
    +++ b/drivers/s390/char/con3270.c
    @@ -465,7 +465,7 @@ con3270_cline_end(struct con3270 *cp)
    s->string[s->len - 4] = TO_RA;
    s->string[s->len - 1] = 0;
    } else {
    - while (--size > cp->cline->len)
    + while (--size >= cp->cline->len)
    s->string[size] = cp->view.ascebc[' '];
    }
    /* Replace cline with allocated line s and reset cline. */

    \
     
     \ /
      Last update: 2016-10-29 16:24    [W:2.269 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site