Commit 267239cc authored Aug 07, 2017 by Heiko Carstens Committed by Martin Schwidefsky Aug 09, 2017

s390/vmcp: fix uaccess check and avoid undefined behavior



The vmcp device driver should return -EFAULT if get_user() fails, due
to an invalid user space address. In addition the buffer size value
from user space is passed unchecked to get_order(). The return value
of get_order(0) undefined.

Therefore explicitly test for zero before calling get_order() and also
return -EFAULT if get_user() fails.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

parent 34ad7cdc

drivers/s390/char/vmcp.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -150,7 +150,9 @@ static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
		get_order(session->bufsize));
		session->response=NULL;
		temp = get_user(session->bufsize, argp);
		if (get_order(session->bufsize) > 8) {
		if (temp)
		session->bufsize = PAGE_SIZE;
		if (!session->bufsize \|\| get_order(session->bufsize) > 8) {
		session->bufsize = PAGE_SIZE;
		temp = -EINVAL;
		}