diff options
| author | Ingo Molnar <mingo@kernel.org> | 2016-05-07 07:00:07 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2016-05-07 07:00:07 +0200 |
| commit | 35dc9ec1076b79c31bf7ed538af008b7f23bb14d (patch) | |
| tree | f90affdd5dc45f47f8d5d84ea34c71e5e521e7a1 /drivers/s390/char/sclp_ctl.c | |
| parent | 0ec7ae928a9c19c2b7b8054507d5694a2597065e (diff) | |
| parent | 07837831047fb72856d1f61a726a4094397facd8 (diff) | |
| download | op-kernel-dev-35dc9ec1076b79c31bf7ed538af008b7f23bb14d.zip op-kernel-dev-35dc9ec1076b79c31bf7ed538af008b7f23bb14d.tar.gz | |
Merge branch 'linus' into efi/core, to pick up fixes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/s390/char/sclp_ctl.c')
| -rw-r--r-- | drivers/s390/char/sclp_ctl.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/drivers/s390/char/sclp_ctl.c b/drivers/s390/char/sclp_ctl.c index 648cb86..ea607a4 100644 --- a/drivers/s390/char/sclp_ctl.c +++ b/drivers/s390/char/sclp_ctl.c @@ -56,6 +56,7 @@ static int sclp_ctl_ioctl_sccb(void __user *user_area) { struct sclp_ctl_sccb ctl_sccb; struct sccb_header *sccb; + unsigned long copied; int rc; if (copy_from_user(&ctl_sccb, user_area, sizeof(ctl_sccb))) @@ -65,14 +66,15 @@ static int sclp_ctl_ioctl_sccb(void __user *user_area) sccb = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA); if (!sccb) return -ENOMEM; - if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sizeof(*sccb))) { + copied = PAGE_SIZE - + copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), PAGE_SIZE); + if (offsetof(struct sccb_header, length) + + sizeof(sccb->length) > copied || sccb->length > copied) { rc = -EFAULT; goto out_free; } - if (sccb->length > PAGE_SIZE || sccb->length < 8) - return -EINVAL; - if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sccb->length)) { - rc = -EFAULT; + if (sccb->length < 8) { + rc = -EINVAL; goto out_free; } rc = sclp_sync_request(ctl_sccb.cmdw, sccb); |
