Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: oprofile: Fix uninitialized memory access when writing to writing to oprofilefs
This commit is contained in:
commit
a205b08218
|
@ -88,7 +88,7 @@ static ssize_t hwsampler_write(struct file *file, char const __user *buf,
|
|||
return -EINVAL;
|
||||
|
||||
retval = oprofilefs_ulong_from_user(&val, buf, count);
|
||||
if (retval)
|
||||
if (retval <= 0)
|
||||
return retval;
|
||||
|
||||
if (oprofile_started)
|
||||
|
|
|
@ -45,7 +45,7 @@ static ssize_t timeout_write(struct file *file, char const __user *buf,
|
|||
return -EINVAL;
|
||||
|
||||
retval = oprofilefs_ulong_from_user(&val, buf, count);
|
||||
if (retval)
|
||||
if (retval <= 0)
|
||||
return retval;
|
||||
|
||||
retval = oprofile_set_timeout(val);
|
||||
|
@ -84,7 +84,7 @@ static ssize_t depth_write(struct file *file, char const __user *buf, size_t cou
|
|||
return -EINVAL;
|
||||
|
||||
retval = oprofilefs_ulong_from_user(&val, buf, count);
|
||||
if (retval)
|
||||
if (retval <= 0)
|
||||
return retval;
|
||||
|
||||
retval = oprofile_set_ulong(&oprofile_backtrace_depth, val);
|
||||
|
@ -141,9 +141,10 @@ static ssize_t enable_write(struct file *file, char const __user *buf, size_t co
|
|||
return -EINVAL;
|
||||
|
||||
retval = oprofilefs_ulong_from_user(&val, buf, count);
|
||||
if (retval)
|
||||
if (retval <= 0)
|
||||
return retval;
|
||||
|
||||
retval = 0;
|
||||
if (val)
|
||||
retval = oprofile_start();
|
||||
else
|
||||
|
|
|
@ -60,6 +60,13 @@ ssize_t oprofilefs_ulong_to_user(unsigned long val, char __user *buf, size_t cou
|
|||
}
|
||||
|
||||
|
||||
/*
|
||||
* Note: If oprofilefs_ulong_from_user() returns 0, then *val remains
|
||||
* unchanged and might be uninitialized. This follows write syscall
|
||||
* implementation when count is zero: "If count is zero ... [and if]
|
||||
* no errors are detected, 0 will be returned without causing any
|
||||
* other effect." (man 2 write)
|
||||
*/
|
||||
int oprofilefs_ulong_from_user(unsigned long *val, char const __user *buf, size_t count)
|
||||
{
|
||||
char tmpbuf[TMPBUFSIZE];
|
||||
|
@ -79,7 +86,7 @@ int oprofilefs_ulong_from_user(unsigned long *val, char const __user *buf, size_
|
|||
raw_spin_lock_irqsave(&oprofilefs_lock, flags);
|
||||
*val = simple_strtoul(tmpbuf, NULL, 0);
|
||||
raw_spin_unlock_irqrestore(&oprofilefs_lock, flags);
|
||||
return 0;
|
||||
return count;
|
||||
}
|
||||
|
||||
|
||||
|
@ -99,7 +106,7 @@ static ssize_t ulong_write_file(struct file *file, char const __user *buf, size_
|
|||
return -EINVAL;
|
||||
|
||||
retval = oprofilefs_ulong_from_user(&value, buf, count);
|
||||
if (retval)
|
||||
if (retval <= 0)
|
||||
return retval;
|
||||
|
||||
retval = oprofile_set_ulong(file->private_data, value);
|
||||
|
|
Loading…
Reference in a new issue