diff options
| author | Joel Stanley <joel@jms.id.au> | 2014-04-24 16:55:35 +0930 |
|---|---|---|
| committer | Benjamin Herrenschmidt <benh@kernel.crashing.org> | 2014-04-28 13:08:48 +1000 |
| commit | 85390378f0a6abf3bdb10c3d504d77862a2d0ec9 (patch) | |
| tree | f4b8f3bec96478f6a5ce0dae9ea0b9ce8ce9b504 /arch | |
| parent | b8569d230416c490065098684adf13c1751cb830 (diff) | |
powerpc/powernv: Check sysfs size before copying
The sysparam code currently uses the userspace supplied number of
bytes when memcpy()ing in to a local 64-byte buffer.
Limit the maximum number of bytes by the size of the buffer.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/powerpc/platforms/powernv/opal-sysparam.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/arch/powerpc/platforms/powernv/opal-sysparam.c b/arch/powerpc/platforms/powernv/opal-sysparam.c index 0675e1a90b4..83f5f2a1c56 100644 --- a/arch/powerpc/platforms/powernv/opal-sysparam.c +++ b/arch/powerpc/platforms/powernv/opal-sysparam.c @@ -135,6 +135,10 @@ static ssize_t sys_param_store(struct kobject *kobj, kobj_attr); ssize_t ret; + /* MAX_PARAM_DATA_LEN is sizeof(param_data_buf) */ + if (count > MAX_PARAM_DATA_LEN) + count = MAX_PARAM_DATA_LEN; + mutex_lock(&opal_sysparam_mutex); memcpy(param_data_buf, buf, count); ret = opal_set_sys_param(attr->param_id, attr->param_size, |