[PATCH] hwtracing: stm: avoid a double-fetch case when fetching policy id
From: Kangjie Lu <hidden>
Date: 2018-12-25 20:00:13
Also in:
lkml
Subsystem:
hardware tracing facilities, system trace module class, the rest · Maintainers:
Alexander Shishkin, Linus Torvalds
"size" is fetched from user space and security checked. The fix avoids fetching it again. Since "size" is no longer used after the second fetch in the current code, so let's just skip copying "size" in the second fetch. Signed-off-by: Kangjie Lu <redacted> --- drivers/hwtracing/stm/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 93ce3aa740a9..55df1d374c57 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c@@ -752,7 +752,8 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg) if (!id) return -ENOMEM; - if (copy_from_user(id, arg, size)) { + if (copy_from_user(id + sizeof(size), + arg + sizeof(size), size - sizeof(size))) { ret = -EFAULT; goto err_free; }
--
2.17.2 (Apple Git-113)
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel