lkml.org 
[lkml]   [2020]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.6 094/166] um: ubd: Prevent buffer overrun on command completion
    Date
    From: Gabriel Krisman Bertazi <krisman@collabora.com>

    [ Upstream commit 6e682d53fc1ef73a169e2a5300326cb23abb32ee ]

    On the hypervisor side, when completing commands and the pipe is full,
    we retry writing only the entries that failed, by offsetting
    io_req_buffer, but we don't reduce the number of bytes written, which
    can cause a buffer overrun of io_req_buffer, and write garbage to the
    pipe.

    Cc: Martyn Welch <martyn.welch@collabora.com>
    Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
    Signed-off-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/um/drivers/ubd_kern.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
    index 247f95da057b5..eca45ad2166c9 100644
    --- a/arch/um/drivers/ubd_kern.c
    +++ b/arch/um/drivers/ubd_kern.c
    @@ -1607,7 +1607,9 @@ int io_thread(void *arg)
    written = 0;

    do {
    - res = os_write_file(kernel_fd, ((char *) io_req_buffer) + written, n);
    + res = os_write_file(kernel_fd,
    + ((char *) io_req_buffer) + written,
    + n - written);
    if (res >= 0) {
    written += res;
    }
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-04-22 12:34    [W:2.441 / U:1.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site