Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cbea9238 authored by Jeremy Kerr's avatar Jeremy Kerr Committed by Paul Mackerras
Browse files

[POWERPC] spufs: Don't leak kernel stack through an empty {i,m}box_info read 



Based on an original patch from Arnd Bergmann
<arnd.bergmann@de.ibm.com>

If there's no entry in the mailbox, then a read on the _info file will
return data from an uninitialised variable.

This change returns EOF if there's no mailbox info available instead.

Signed-off-by: default avatarJeremy Kerr <jk@ozlabs.org>
Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
parent 18789fb1

arch/powerpc/platforms/cell/spufs/file.c

+10 −10
Original line number Diff line number Diff line
@@ -2026,13 +2026,13 @@ static const struct file_operations spufs_caps_fops = { 
static ssize_t __spufs_mbox_info_read(struct spu_context *ctx,

			char __user *buf, size_t len, loff_t *pos)

{

	u32 mbox_stat;

	u32 data;



	mbox_stat = ctx->csa.prob.mb_stat_R;

	if (mbox_stat & 0x0000ff) {

	/* EOF if there's no entry in the mbox */

	if (!(ctx->csa.prob.mb_stat_R & 0x0000ff))

		return 0;



	data = ctx->csa.prob.pu_mb_R;

	}



	return simple_read_from_buffer(buf, len, pos, &data, sizeof data);

}
@@ -2066,13 +2066,13 @@ static const struct file_operations spufs_mbox_info_fops = { 
static ssize_t __spufs_ibox_info_read(struct spu_context *ctx,

				char __user *buf, size_t len, loff_t *pos)

{

	u32 ibox_stat;

	u32 data;



	ibox_stat = ctx->csa.prob.mb_stat_R;

	if (ibox_stat & 0xff0000) {

	/* EOF if there's no entry in the ibox */

	if (!(ctx->csa.prob.mb_stat_R & 0xff0000))

		return 0;



	data = ctx->csa.priv2.puint_mb_R;

	}



	return simple_read_from_buffer(buf, len, pos, &data, sizeof data);

}