diff options
| author |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-05-09 09:39:13 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-05-09 09:39:13 +0200 |
| commit | 10ee08292028d3d22d201a34ba7d24a085818cb3 (patch) | |
| tree | cf3bff48a7eab154574355f00a4b4f27dc85ff11 /drivers/s390 | |
| parent | serial: core: Fix port mutex assert if lockdep disabled (diff) | |
| parent | Linux 4.6-rc7 (diff) | |
| download | linux-dev-10ee08292028d3d22d201a34ba7d24a085818cb3.tar.xz linux-dev-10ee08292028d3d22d201a34ba7d24a085818cb3.zip | |
Merge 4.6-rc7 into tty-next
We want the pty fixes in here as well so that patches can build on it.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/s390')
| -rw-r--r-- | drivers/s390/char/sclp_ctl.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/drivers/s390/char/sclp_ctl.c b/drivers/s390/char/sclp_ctl.c index 648cb86afd42..ea607a4a1bdd 100644 --- a/drivers/s390/char/sclp_ctl.c +++ b/drivers/s390/char/sclp_ctl.c @@ -56,6 +56,7 @@ static int sclp_ctl_ioctl_sccb(void __user *user_area) { struct sclp_ctl_sccb ctl_sccb; struct sccb_header *sccb; + unsigned long copied; int rc; if (copy_from_user(&ctl_sccb, user_area, sizeof(ctl_sccb))) @@ -65,14 +66,15 @@ static int sclp_ctl_ioctl_sccb(void __user *user_area) sccb = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA); if (!sccb) return -ENOMEM; - if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sizeof(*sccb))) { + copied = PAGE_SIZE - + copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), PAGE_SIZE); + if (offsetof(struct sccb_header, length) + + sizeof(sccb->length) > copied || sccb->length > copied) { rc = -EFAULT; goto out_free; } - if (sccb->length > PAGE_SIZE || sccb->length < 8) - return -EINVAL; - if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sccb->length)) { - rc = -EFAULT; + if (sccb->length < 8) { + rc = -EINVAL; goto out_free; } rc = sclp_sync_request(ctl_sccb.cmdw, sccb); |