forked from Minki/linux
oprofile: Fix uninitialized memory access when writing to writing to oprofilefs
If oprofilefs_ulong_from_user() is called with count equals zero, *val remains unchanged. Depending on the implementation it might be uninitialized. Change oprofilefs_ulong_from_user()'s interface to return count on success. Thus, we are able to return early if count equals zero which avoids using *val uninitialized. Fixing all users of oprofilefs_ulong_ from_user(). This follows write syscall implementation when count is zero: "If count is zero ... [and if] no errors are detected, 0 will be returned without causing any other effect." (man 2 write) Reported-By: Mike Waychison <mikew@google.com> Signed-off-by: Robert Richter <robert.richter@amd.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: <stable@vger.kernel.org> Cc: oprofile-list <oprofile-list@lists.sourceforge.net> Link: http://lkml.kernel.org/r/20111219153830.GH16765@erda.amd.com Signed-off-by: Ingo Molnar <mingo@elte.hu>
This commit is contained in:
parent
497f16f21a
commit
913050b91e
@ -88,7 +88,7 @@ static ssize_t hwsampler_write(struct file *file, char const __user *buf,
|
||||
return -EINVAL;
|
||||
|
||||
retval = oprofilefs_ulong_from_user(&val, buf, count);
|
||||
if (retval)
|
||||
if (retval <= 0)
|
||||
return retval;
|
||||
|
||||
if (oprofile_started)
|
||||
|
@ -45,7 +45,7 @@ static ssize_t timeout_write(struct file *file, char const __user *buf,
|
||||
return -EINVAL;
|
||||
|
||||
retval = oprofilefs_ulong_from_user(&val, buf, count);
|
||||
if (retval)
|
||||
if (retval <= 0)
|
||||
return retval;
|
||||
|
||||
retval = oprofile_set_timeout(val);
|
||||
@ -84,7 +84,7 @@ static ssize_t depth_write(struct file *file, char const __user *buf, size_t cou
|
||||
return -EINVAL;
|
||||
|
||||
retval = oprofilefs_ulong_from_user(&val, buf, count);
|
||||
if (retval)
|
||||
if (retval <= 0)
|
||||
return retval;
|
||||
|
||||
retval = oprofile_set_ulong(&oprofile_backtrace_depth, val);
|
||||
@ -141,9 +141,10 @@ static ssize_t enable_write(struct file *file, char const __user *buf, size_t co
|
||||
return -EINVAL;
|
||||
|
||||
retval = oprofilefs_ulong_from_user(&val, buf, count);
|
||||
if (retval)
|
||||
if (retval <= 0)
|
||||
return retval;
|
||||
|
||||
retval = 0;
|
||||
if (val)
|
||||
retval = oprofile_start();
|
||||
else
|
||||
|
@ -60,6 +60,13 @@ ssize_t oprofilefs_ulong_to_user(unsigned long val, char __user *buf, size_t cou
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* Note: If oprofilefs_ulong_from_user() returns 0, then *val remains
|
||||
* unchanged and might be uninitialized. This follows write syscall
|
||||
* implementation when count is zero: "If count is zero ... [and if]
|
||||
* no errors are detected, 0 will be returned without causing any
|
||||
* other effect." (man 2 write)
|
||||
*/
|
||||
int oprofilefs_ulong_from_user(unsigned long *val, char const __user *buf, size_t count)
|
||||
{
|
||||
char tmpbuf[TMPBUFSIZE];
|
||||
@ -79,7 +86,7 @@ int oprofilefs_ulong_from_user(unsigned long *val, char const __user *buf, size_
|
||||
raw_spin_lock_irqsave(&oprofilefs_lock, flags);
|
||||
*val = simple_strtoul(tmpbuf, NULL, 0);
|
||||
raw_spin_unlock_irqrestore(&oprofilefs_lock, flags);
|
||||
return 0;
|
||||
return count;
|
||||
}
|
||||
|
||||
|
||||
@ -99,7 +106,7 @@ static ssize_t ulong_write_file(struct file *file, char const __user *buf, size_
|
||||
return -EINVAL;
|
||||
|
||||
retval = oprofilefs_ulong_from_user(&value, buf, count);
|
||||
if (retval)
|
||||
if (retval <= 0)
|
||||
return retval;
|
||||
|
||||
retval = oprofile_set_ulong(file->private_data, value);
|
||||
|
Loading…
Reference in New Issue
Block a user