diff options
| author | Gabriel Krisman Bertazi <krisman@collabora.com> | 2020-03-17 03:45:06 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-04-23 11:38:10 +0300 |
| commit | 11917049debbba73882c57f5703bd9cbfb612091 (patch) | |
| tree | b29c99444c9b624b4d48978ec8a693476bca101f | |
| parent | bf28c63c48bb03e4b2b76dcf6a1f8d30e71b41b3 (diff) | |
| download | linux-11917049debbba73882c57f5703bd9cbfb612091.tar.xz | |
um: ubd: Prevent buffer overrun on command completion
[ Upstream commit 6e682d53fc1ef73a169e2a5300326cb23abb32ee ]
On the hypervisor side, when completing commands and the pipe is full,
we retry writing only the entries that failed, by offsetting
io_req_buffer, but we don't reduce the number of bytes written, which
can cause a buffer overrun of io_req_buffer, and write garbage to the
pipe.
Cc: Martyn Welch <martyn.welch@collabora.com>
Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | arch/um/drivers/ubd_kern.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c index 247f95da057b..eca45ad2166c 100644 --- a/arch/um/drivers/ubd_kern.c +++ b/arch/um/drivers/ubd_kern.c @@ -1607,7 +1607,9 @@ int io_thread(void *arg) written = 0; do { - res = os_write_file(kernel_fd, ((char *) io_req_buffer) + written, n); + res = os_write_file(kernel_fd, + ((char *) io_req_buffer) + written, + n - written); if (res >= 0) { written += res; } |