diff options
| author |   Andrew Morton <akpm@linux-foundation.org> | 2025-06-07 17:43:18 -0700 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2025-06-11 22:42:36 -0700 |
| commit | 50695153d7ddde3b1696dbf0085be0033bf3ddb3 (patch) | |
| tree | a698a261d85c01acb5067b778a0ace02a5ab86b9 /tools/perf/scripts/python/export-to-postgresql.py | |
| parent | mm: close theoretical race where stale TLB entries could linger (diff) | |
| download | wireguard-linux-50695153d7ddde3b1696dbf0085be0033bf3ddb3.tar.xz wireguard-linux-50695153d7ddde3b1696dbf0085be0033bf3ddb3.zip | |
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
In
riocm_cdev_ioctl(RIO_CM_CHAN_SEND)
-> cm_chan_msg_send()
-> riocm_ch_send()
cm_chan_msg_send() checks that userspace didn't send too much data but
riocm_ch_send() failed to check that userspace sent sufficient data. The
result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr
which were outside the bounds of the space which cm_chan_msg_send()
allocated.
Address this by teaching riocm_ch_send() to check that the entire
rio_ch_chan_hdr was copied in from userspace.
Reported-by: maher azz <maherazz04@gmail.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Linus Torvalds <torvalds@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'tools/perf/scripts/python/export-to-postgresql.py')
0 files changed, 0 insertions, 0 deletions