Skip to content

Commit

Permalink
s390/uaccess: fix strncpy_from_user/strnlen_user zero maxlen case
Browse files Browse the repository at this point in the history
If the maximum length specified for the to be accessed string for
strncpy_from_user() and strnlen_user() is zero the following incorrect
values would be returned or incorrect memory accesses would happen:

strnlen_user_std() and strnlen_user_pt() incorrectly return "1"
strncpy_from_user_pt() would incorrectly access "dst[maxlen - 1]"
strncpy_from_user_mvcos() would incorrectly return "-EFAULT"

Fix all these oddities by adding early checks.

Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
  • Loading branch information
Heiko Carstens authored and Martin Schwidefsky committed Feb 28, 2013
1 parent d7b788c commit f45655f
Show file tree
Hide file tree
Showing 3 changed files with 8 additions and 0 deletions.
2 changes: 2 additions & 0 deletions arch/s390/lib/uaccess_mvcos.c
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,8 @@ static size_t strncpy_from_user_mvcos(size_t count, const char __user *src,
{
size_t done, len, offset, len_str;

if (unlikely(!count))
return 0;
done = 0;
do {
offset = (size_t)src & ~PAGE_MASK;
Expand Down
4 changes: 4 additions & 0 deletions arch/s390/lib/uaccess_pt.c
Original file line number Diff line number Diff line change
Expand Up @@ -172,6 +172,8 @@ static size_t strnlen_user_pt(size_t count, const char __user *src)
unsigned long offset, done, len, kaddr;
size_t len_str;

if (unlikely(!count))
return 0;
if (segment_eq(get_fs(), KERNEL_DS))
return strnlen((const char __kernel __force *) src, count) + 1;
done = 0;
Expand Down Expand Up @@ -202,6 +204,8 @@ static size_t strncpy_from_user_pt(size_t count, const char __user *src,
{
size_t n = strnlen_user_pt(count, src);

if (unlikely(!count))
return 0;
if (!n)
return -EFAULT;
if (n > count)
Expand Down
2 changes: 2 additions & 0 deletions arch/s390/lib/uaccess_std.c
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,8 @@ size_t strnlen_user_std(size_t size, const char __user *src)
register unsigned long reg0 asm("0") = 0UL;
unsigned long tmp1, tmp2;

if (unlikely(!size))
return 0;
asm volatile(
" la %2,0(%1)\n"
" la %3,0(%0,%1)\n"
Expand Down

0 comments on commit f45655f

Please sign in to comment.