Commit f0483044 authored by Sebastian Ott's avatar Sebastian Ott Committed by Martin Schwidefsky

s390/pci: fix possible information leak in mmio syscall

Make sure that even in error situations we do not use copy_to_user
on uninitialized kernel memory.

Cc: stable@vger.kernel.org # 3.19+
Signed-off-by: default avatarSebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent 3a9f9183
......@@ -64,8 +64,7 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, unsigned long, mmio_addr,
if (copy_from_user(buf, user_buffer, length))
goto out;
memcpy_toio(io_addr, buf, length);
ret = 0;
ret = zpci_memcpy_toio(io_addr, buf, length);
out:
if (buf != local_buf)
kfree(buf);
......@@ -98,16 +97,16 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr,
goto out;
io_addr = (void __iomem *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));
if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE) {
ret = -EFAULT;
if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
goto out;
memcpy_fromio(buf, io_addr, length);
if (copy_to_user(user_buffer, buf, length))
}
ret = zpci_memcpy_fromio(buf, io_addr, length);
if (ret)
goto out;
if (copy_to_user(user_buffer, buf, length))
ret = -EFAULT;
ret = 0;
out:
if (buf != local_buf)
kfree(buf);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment