diff options
| author | David S. Miller <davem@davemloft.net> | 2016-05-04 07:52:29 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-05-04 07:52:29 +0300 |
| commit | cba653210056cf47cc1969f831f05ddfb99ee2bd (patch) | |
| tree | 92d93a3eee5b12d77af3696b9da8026e71df5752 /drivers/s390 | |
| parent | 26879da58711aa604a1b866cbeedd7e0f78f90ad (diff) | |
| parent | 7391daf2ffc780679d6ab3fad1db2619e5dd2c2a (diff) | |
| download | linux-cba653210056cf47cc1969f831f05ddfb99ee2bd.tar.xz | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Conflicts:
net/ipv4/ip_gre.c
Minor conflicts between tunnel bug fixes in net and
ipv6 tunnel cleanups in net-next.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/s390')
| -rw-r--r-- | drivers/s390/char/sclp_ctl.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/drivers/s390/char/sclp_ctl.c b/drivers/s390/char/sclp_ctl.c index 648cb86afd42..ea607a4a1bdd 100644 --- a/drivers/s390/char/sclp_ctl.c +++ b/drivers/s390/char/sclp_ctl.c @@ -56,6 +56,7 @@ static int sclp_ctl_ioctl_sccb(void __user *user_area) { struct sclp_ctl_sccb ctl_sccb; struct sccb_header *sccb; + unsigned long copied; int rc; if (copy_from_user(&ctl_sccb, user_area, sizeof(ctl_sccb))) @@ -65,14 +66,15 @@ static int sclp_ctl_ioctl_sccb(void __user *user_area) sccb = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA); if (!sccb) return -ENOMEM; - if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sizeof(*sccb))) { + copied = PAGE_SIZE - + copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), PAGE_SIZE); + if (offsetof(struct sccb_header, length) + + sizeof(sccb->length) > copied || sccb->length > copied) { rc = -EFAULT; goto out_free; } - if (sccb->length > PAGE_SIZE || sccb->length < 8) - return -EINVAL; - if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sccb->length)) { - rc = -EFAULT; + if (sccb->length < 8) { + rc = -EINVAL; goto out_free; } rc = sclp_sync_request(ctl_sccb.cmdw, sccb); |