s390/vmcp: fix uaccess check and avoid undefined behavior
The vmcp device driver should return -EFAULT if get_user() fails, due to an invalid user space address. In addition the buffer size value from user space is passed unchecked to get_order(). The return value of get_order(0) undefined. Therefore explicitly test for zero before calling get_order() and also return -EFAULT if get_user() fails. Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
parent
34ad7cdc1b
commit
267239cc10
|
@ -150,7 +150,9 @@ static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
|||
get_order(session->bufsize));
|
||||
session->response=NULL;
|
||||
temp = get_user(session->bufsize, argp);
|
||||
if (get_order(session->bufsize) > 8) {
|
||||
if (temp)
|
||||
session->bufsize = PAGE_SIZE;
|
||||
if (!session->bufsize || get_order(session->bufsize) > 8) {
|
||||
session->bufsize = PAGE_SIZE;
|
||||
temp = -EINVAL;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue