mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 09:59:32 +00:00
![]() The hm->h.size is intended to hold the actual size of the hm struct that is copied from userspace and should always be <= sizeof(*hm). However, after copy_from_user(hm, puhm, hm->h.size), since userspace process has full control over the memory region pointed by puhm, it is possible that the value of hm->h.size is different from what is fetched-in previously (get_user(hm->h.size, (u16 __user *)puhm)). In other words, hm->h.size is overriden and the relation between hm->h.size and the hm struct is broken. This patch proposes to use a seperate variable, msg_size, to hold the value of the first fetch and override hm->h.size to msg_size after the second fetch to maintain the relation. Signed-off-by: Meng Xu <mengxu.gatech@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
---|---|---|
.. | ||
asihpi.c | ||
hpi.h | ||
hpi6000.c | ||
hpi6000.h | ||
hpi6205.c | ||
hpi6205.h | ||
hpi_internal.h | ||
hpi_version.h | ||
hpicmn.c | ||
hpicmn.h | ||
hpidebug.c | ||
hpidebug.h | ||
hpidspcd.c | ||
hpidspcd.h | ||
hpifunc.c | ||
hpimsginit.c | ||
hpimsginit.h | ||
hpimsgx.c | ||
hpimsgx.h | ||
hpioctl.c | ||
hpioctl.h | ||
hpios.c | ||
hpios.h | ||
hpipcida.h | ||
Makefile |