diff options
| author |   Vasily Gorbik <gor@linux.ibm.com> | 2026-04-17 14:33:43 +0200 |
|---|---|---|
| committer |   Alexander Gordeev <agordeev@linux.ibm.com> | 2026-04-28 14:45:02 +0200 |
| commit | e14622a7584f9608927c59a7d6ae4a0999dc545e (patch) | |
| tree | 88e1b377ef7b563aaff15d539458d9de376b6363 /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | s390/debug: Reject zero-length input before trimming a newline (diff) | |
s390/debug: Reject zero-length input in debug_input_flush_fn()
debug_input_flush_fn() always copies one byte from the userspace buffer
with copy_from_user() regardless of the supplied write length. A
zero-length write therefore reads one byte beyond the caller's buffer.
If the stale byte happens to be '-' or a digit the debug log is
silently flushed. With an unmapped buffer the call returns -EFAULT.
Reject zero-length writes before copying from userspace.
Cc: stable@vger.kernel.org # v5.10+
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions