lkml.org 
[lkml]   [2015]   [Mar]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19 059/123] s390/pci: fix possible information leak in mmio syscall
    Date
    3.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Sebastian Ott <sebott@linux.vnet.ibm.com>

    commit f0483044c1c96089256cda4cf182eea1ead77fe4 upstream.

    Make sure that even in error situations we do not use copy_to_user
    on uninitialized kernel memory.

    Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/s390/pci/pci_mmio.c | 17 ++++++++---------
    1 file changed, 8 insertions(+), 9 deletions(-)

    --- a/arch/s390/pci/pci_mmio.c
    +++ b/arch/s390/pci/pci_mmio.c
    @@ -64,8 +64,7 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, uns
    if (copy_from_user(buf, user_buffer, length))
    goto out;

    - memcpy_toio(io_addr, buf, length);
    - ret = 0;
    + ret = zpci_memcpy_toio(io_addr, buf, length);
    out:
    if (buf != local_buf)
    kfree(buf);
    @@ -98,16 +97,16 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsi
    goto out;
    io_addr = (void *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));

    - ret = -EFAULT;
    - if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
    + if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE) {
    + ret = -EFAULT;
    goto out;
    -
    - memcpy_fromio(buf, io_addr, length);
    -
    - if (copy_to_user(user_buffer, buf, length))
    + }
    + ret = zpci_memcpy_fromio(buf, io_addr, length);
    + if (ret)
    goto out;
    + if (copy_to_user(user_buffer, buf, length))
    + ret = -EFAULT;

    - ret = 0;
    out:
    if (buf != local_buf)
    kfree(buf);



    \
     
     \ /
      Last update: 2015-03-24 19:01    [W:3.023 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site