mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

[POWERPC] spufs: Don't leak kernel stack through an empty {i,m}box_info read 

Based on an original patch from Arnd Bergmann
<arnd.bergmann@de.ibm.com>

If there's no entry in the mailbox, then a read on the _info file will
return data from an uninitialised variable.

This change returns EOF if there's no mailbox info available instead.

Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
This commit is contained in:
Jeremy Kerr 2007-12-20 16:39:59 +09:00 committed by Paul Mackerras
parent 18789fb1c3
commit cbea92383d
1 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
arch/powerpc/platforms/cell/spufs/file.c
View File

@ -2026,13 +2026,13 @@ static const struct file_operations spufs_caps_fops = {
static ssize_t __spufs_mbox_info_read(struct spu_context *ctx,
char __user *buf, size_t len, loff_t *pos)
{
u32 mbox_stat;
u32 data;
mbox_stat = ctx->csa.prob.mb_stat_R;
if (mbox_stat & 0x0000ff) {
data = ctx->csa.prob.pu_mb_R;
}
/* EOF if there's no entry in the mbox */
if (!(ctx->csa.prob.mb_stat_R & 0x0000ff))
return 0;
data = ctx->csa.prob.pu_mb_R;
return simple_read_from_buffer(buf, len, pos, &data, sizeof data);
}
@ -2066,13 +2066,13 @@ static const struct file_operations spufs_mbox_info_fops = {
static ssize_t __spufs_ibox_info_read(struct spu_context *ctx,
char __user *buf, size_t len, loff_t *pos)
{
u32 ibox_stat;
u32 data;
ibox_stat = ctx->csa.prob.mb_stat_R;
if (ibox_stat & 0xff0000) {
data = ctx->csa.priv2.puint_mb_R;
}
/* EOF if there's no entry in the ibox */
if (!(ctx->csa.prob.mb_stat_R & 0xff0000))
return 0;
data = ctx->csa.priv2.puint_mb_R;
return simple_read_from_buffer(buf, len, pos, &data, sizeof data);
}