OSDN Git Service

ibmasm: don't write out of bounds in read handler
authorJann Horn <jannh@google.com>
Sat, 7 Jul 2018 02:16:33 +0000 (04:16 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 17 Jul 2018 09:31:42 +0000 (11:31 +0200)
commitba20e67aee81bf01dc6154e91bcfee431f1bb678
tree8222120dbb6ea045b89fe5f4abd4cc7dc2b31c89
parentbc20ab941e5e1523198b18943f9ca66e269e20a0
ibmasm: don't write out of bounds in read handler

commit a0341fc1981a950c1e902ab901e98f60e0e243f3 upstream.

This read handler had a lot of custom logic and wrote outside the bounds of
the provided buffer. This could lead to kernel and userspace memory
corruption. Just use simple_read_from_buffer() with a stack buffer.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/ibmasm/ibmasmfs.c