diff options
| author | Andy Walker <andy@puszczka.com> | 2006-09-18 07:11:36 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2006-09-18 07:11:36 -0700 |
| commit | b9c54f91a48146778fe91423d4d467a0ee8c719b (patch) | |
| tree | f123be6ee2fb44b5795a3aa6f0ccbc8e9ea19d2b /arch | |
| parent | b9b64e6e89fc5a6ef220747115c5b7764614ca3f (diff) | |
[SPARC]: Fix regression in sys_getdomainname()
This patch corrects the buffer length checking in the
sys_getdomainname() implementation for sparc/sparc64.
Signed-off-by: Andy Walker <andy@puszczka.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/sparc/kernel/sys_sparc.c | 10 | ||||
| -rw-r--r-- | arch/sparc64/kernel/sys_sparc.c | 10 |
2 files changed, 12 insertions, 8 deletions
diff --git a/arch/sparc/kernel/sys_sparc.c b/arch/sparc/kernel/sys_sparc.c index 94ff58c9d4a9..896863fb208a 100644 --- a/arch/sparc/kernel/sys_sparc.c +++ b/arch/sparc/kernel/sys_sparc.c @@ -470,19 +470,21 @@ asmlinkage int sys_getdomainname(char __user *name, int len) { int nlen, err; - if (len < 0 || len > __NEW_UTS_LEN) + if (len < 0) return -EINVAL; down_read(&uts_sem); nlen = strlen(system_utsname.domainname) + 1; - if (nlen < len) - len = nlen; + err = -EINVAL; + if (nlen > len) + goto out; err = -EFAULT; - if (!copy_to_user(name, system_utsname.domainname, len)) + if (!copy_to_user(name, system_utsname.domainname, nlen)) err = 0; +out: up_read(&uts_sem); return err; } diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c index bf5f14ee73de..c608c947e6c3 100644 --- a/arch/sparc64/kernel/sys_sparc.c +++ b/arch/sparc64/kernel/sys_sparc.c @@ -707,19 +707,21 @@ asmlinkage long sys_getdomainname(char __user *name, int len) { int nlen, err; - if (len < 0 || len > __NEW_UTS_LEN) + if (len < 0) return -EINVAL; down_read(&uts_sem); nlen = strlen(system_utsname.domainname) + 1; - if (nlen < len) - len = nlen; + err = -EINVAL; + if (nlen > len) + goto out; err = -EFAULT; - if (!copy_to_user(name, system_utsname.domainname, len)) + if (!copy_to_user(name, system_utsname.domainname, nlen)) err = 0; +out: up_read(&uts_sem); return err; } |