diff options
| author | Joel Stanley <joel@jms.id.au> | 2014-04-22 18:37:35 +1000 |
|---|---|---|
| committer | Eli Qiao <taget@linux.vnet.ibm.com> | 2014-04-22 16:55:30 +0800 |
| commit | f76b84f4a85276fce8591c1d39ae2e919d9a9476 (patch) | |
| tree | 024c1d0759e96e55f1707689b3391ebb8e19cb63 | |
| parent | e174d946ff2c867da52998bbfa82bf9cf0eae527 (diff) | |
| download | powerkvm-f76b84f4a85276fce8591c1d39ae2e919d9a9476.tar.gz | |
powerpc/powernv: Check sysfs size before copying
The sysparam code currently uses the userspace supplied number of
bytes when memcpy()ing in to a local 64-byte buffer.
Limit the maximum number of bytes by the size of the buffer.
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
| -rw-r--r-- | arch/powerpc/platforms/powernv/opal-sysparam.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/arch/powerpc/platforms/powernv/opal-sysparam.c b/arch/powerpc/platforms/powernv/opal-sysparam.c index 54025cf453d4d..f8e013bdbd23b 100644 --- a/arch/powerpc/platforms/powernv/opal-sysparam.c +++ b/arch/powerpc/platforms/powernv/opal-sysparam.c @@ -135,6 +135,10 @@ static ssize_t sys_param_store(struct kobject *kobj, kobj_attr); ssize_t ret; + /* MAX_PARAM_DATA_LEN is sizeof(param_data_buf) */ + if (count > MAX_PARAM_DATA_LEN) + count = MAX_PARAM_DATA_LEN; + mutex_lock(&opal_sysparam_mutex); memcpy(param_data_buf, buf, count); ret = opal_set_sys_param(attr->param_id, attr->param_size, |