Browse Source

powerpc/powernv: Check sysfs size before copying

The sysparam code currently uses the userspace supplied number of
bytes when memcpy()ing in to a local 64-byte buffer.

Limit the maximum number of bytes by the size of the buffer.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Joel Stanley 11 years ago
parent
commit
85390378f0
1 changed files with 4 additions and 0 deletions
  1. 4 0
      arch/powerpc/platforms/powernv/opal-sysparam.c

+ 4 - 0
arch/powerpc/platforms/powernv/opal-sysparam.c

@@ -135,6 +135,10 @@ static ssize_t sys_param_store(struct kobject *kobj,
 			kobj_attr);
 	ssize_t ret;
 
+        /* MAX_PARAM_DATA_LEN is sizeof(param_data_buf) */
+        if (count > MAX_PARAM_DATA_LEN)
+                count = MAX_PARAM_DATA_LEN;
+
 	mutex_lock(&opal_sysparam_mutex);
 	memcpy(param_data_buf, buf, count);
 	ret = opal_set_sys_param(attr->param_id, attr->param_size,