Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f0483044 authored by Sebastian Ott's avatar Sebastian Ott Committed by Martin Schwidefsky
Browse files

s390/pci: fix possible information leak in mmio syscall 



Make sure that even in error situations we do not use copy_to_user
on uninitialized kernel memory.

Cc: stable@vger.kernel.org # 3.19+
Signed-off-by: default avatarSebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent 3a9f9183

arch/s390/pci/pci_mmio.c

+8 −9
Original line number Diff line number Diff line
@@ -64,8 +64,7 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, unsigned long, mmio_addr, 
	if (copy_from_user(buf, user_buffer, length))

		goto out;



	memcpy_toio(io_addr, buf, length);

	ret = 0;

	ret = zpci_memcpy_toio(io_addr, buf, length);

out:

	if (buf != local_buf)

		kfree(buf);
@@ -98,16 +97,16 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr, 
		goto out;

	io_addr = (void __iomem *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));



	if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE) {

		ret = -EFAULT;

	if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)

		goto out;



	memcpy_fromio(buf, io_addr, length);



	if (copy_to_user(user_buffer, buf, length))

	}

	ret = zpci_memcpy_fromio(buf, io_addr, length);

	if (ret)

		goto out;

	if (copy_to_user(user_buffer, buf, length))

		ret = -EFAULT;



	ret = 0;

out:

	if (buf != local_buf)

		kfree(buf);