Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a205b082 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  oprofile: Fix uninitialized memory access when writing to writing to oprofilefs
parents 455ba0c0 913050b9

arch/s390/oprofile/init.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -88,7 +88,7 @@ static ssize_t hwsampler_write(struct file *file, char const __user *buf, 
		return -EINVAL;

		return -EINVAL;





	retval = oprofilefs_ulong_from_user(&val, buf, count);

	retval = oprofilefs_ulong_from_user(&val, buf, count);

	if (retval)

	if (retval <= 0)

		return retval;

		return retval;





	if (oprofile_started)

	if (oprofile_started)

drivers/oprofile/oprofile_files.c

+4 −3
Original line number Original line Diff line number Diff line
@@ -45,7 +45,7 @@ static ssize_t timeout_write(struct file *file, char const __user *buf, 
		return -EINVAL;

		return -EINVAL;





	retval = oprofilefs_ulong_from_user(&val, buf, count);

	retval = oprofilefs_ulong_from_user(&val, buf, count);

	if (retval)

	if (retval <= 0)

		return retval;

		return retval;





	retval = oprofile_set_timeout(val);

	retval = oprofile_set_timeout(val);
@@ -84,7 +84,7 @@ static ssize_t depth_write(struct file *file, char const __user *buf, size_t cou 
		return -EINVAL;

		return -EINVAL;





	retval = oprofilefs_ulong_from_user(&val, buf, count);

	retval = oprofilefs_ulong_from_user(&val, buf, count);

	if (retval)

	if (retval <= 0)

		return retval;

		return retval;





	retval = oprofile_set_ulong(&oprofile_backtrace_depth, val);

	retval = oprofile_set_ulong(&oprofile_backtrace_depth, val);
@@ -141,9 +141,10 @@ static ssize_t enable_write(struct file *file, char const __user *buf, size_t co 
		return -EINVAL;

		return -EINVAL;





	retval = oprofilefs_ulong_from_user(&val, buf, count);

	retval = oprofilefs_ulong_from_user(&val, buf, count);

	if (retval)

	if (retval <= 0)

		return retval;

		return retval;





	retval = 0;

	if (val)

	if (val)

		retval = oprofile_start();

		retval = oprofile_start();

	else

	else

drivers/oprofile/oprofilefs.c

+9 −2
Original line number Original line Diff line number Diff line
@@ -60,6 +60,13 @@ ssize_t oprofilefs_ulong_to_user(unsigned long val, char __user *buf, size_t cou 
}

}









/*

 * Note: If oprofilefs_ulong_from_user() returns 0, then *val remains

 * unchanged and might be uninitialized. This follows write syscall

 * implementation when count is zero: "If count is zero ... [and if]

 * no errors are detected, 0 will be returned without causing any

 * other effect." (man 2 write)

 */

int oprofilefs_ulong_from_user(unsigned long *val, char const __user *buf, size_t count)

int oprofilefs_ulong_from_user(unsigned long *val, char const __user *buf, size_t count)

{

{

	char tmpbuf[TMPBUFSIZE];

	char tmpbuf[TMPBUFSIZE];
@@ -79,7 +86,7 @@ int oprofilefs_ulong_from_user(unsigned long *val, char const __user *buf, size_ 
	raw_spin_lock_irqsave(&oprofilefs_lock, flags);

	raw_spin_lock_irqsave(&oprofilefs_lock, flags);

	*val = simple_strtoul(tmpbuf, NULL, 0);

	*val = simple_strtoul(tmpbuf, NULL, 0);

	raw_spin_unlock_irqrestore(&oprofilefs_lock, flags);

	raw_spin_unlock_irqrestore(&oprofilefs_lock, flags);

	return 0;

	return count;

}

}
@@ -99,7 +106,7 @@ static ssize_t ulong_write_file(struct file *file, char const __user *buf, size_ 
		return -EINVAL;

		return -EINVAL;





	retval = oprofilefs_ulong_from_user(&value, buf, count);

	retval = oprofilefs_ulong_from_user(&value, buf, count);

	if (retval)

	if (retval <= 0)

		return retval;

		return retval;





	retval = oprofile_set_ulong(file->private_data, value);

	retval = oprofile_set_ulong(file->private_data, value);