openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

s390/pci: fix possible information leak in mmio syscall 

Make sure that even in error situations we do not use copy_to_user
on uninitialized kernel memory.

Cc: stable@vger.kernel.org # 3.19+
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
Sebastian Ott 2015-02-25 13:17:48 +01:00 committed by Martin Schwidefsky
parent 3a9f9183bd
commit f0483044c1
1 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
arch/s390/pci/pci_mmio.c
View File

@ -64,8 +64,7 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, unsigned long, mmio_addr,
if (copy_from_user(buf, user_buffer, length))
goto out;
memcpy_toio(io_addr, buf, length);
ret = 0;
ret = zpci_memcpy_toio(io_addr, buf, length);
out:
if (buf != local_buf)
kfree(buf);
@ -98,16 +97,16 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr,
goto out;
io_addr = (void __iomem *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));
ret = -EFAULT;
if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE) {
ret = -EFAULT;
goto out;
}
ret = zpci_memcpy_fromio(buf, io_addr, length);
if (ret)
goto out;
memcpy_fromio(buf, io_addr, length);
if (copy_to_user(user_buffer, buf, length))
goto out;
ret = -EFAULT;
ret = 0;
out:
if (buf != local_buf)
kfree(buf);