Commit 1421615c authored Mar 16, 2020 by Gabriel Krisman Bertazi Committed by Greg Kroah-Hartman Apr 23, 2020

um: ubd: Prevent buffer overrun on command completion



[ Upstream commit 6e682d53fc1ef73a169e2a5300326cb23abb32ee ]

On the hypervisor side, when completing commands and the pipe is full,
we retry writing only the entries that failed, by offsetting
io_req_buffer, but we don't reduce the number of bytes written, which
can cause a buffer overrun of io_req_buffer, and write garbage to the
pipe.

Cc: Martyn Welch <martyn.welch@collabora.com>
Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 6e2fa8b3

arch/um/drivers/ubd_kern.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -1574,7 +1574,9 @@ int io_thread(void *arg)
		written = 0;

		do {
		res = os_write_file(kernel_fd, ((char *) io_req_buffer) + written, n);
		res = os_write_file(kernel_fd,
		((char *) io_req_buffer) + written,
		n - written);
		if (res >= 0) {
		written += res;
		} else {