diff options
| author | Andrew Donnellan <andrew.donnellan@au1.ibm.com> | 2016-03-18 17:36:33 +1100 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2016-07-05 23:49:52 +1000 |
| commit | a9862c7440f191439a51f77233f89f7e40efe02e (patch) | |
| tree | da9a2947eb2a1e0411a8657395c0e5dc2de468e5 /arch/powerpc/kernel/rtas.c | |
| parent | 4375088072295b09cc5d9bf7a8cd2333b608492a (diff) | |
powerpc/rtas: Fix array overrun in ppc_rtas() syscall
If ppc_rtas() is called with args.nargs == 16 and args.nret == 0,
args.rets is set to point to &args.args[16], which is beyond the end of
the args.args array. This results in a minor read overrun of the array
when we check the first return code (which, per PAPR, is a required
output of all RTAS calls) to see if there's been a hardware error.
Change the nargs/nret check to ensure nargs is <= 15, allowing room for
the status code. Users shouldn't be calling with nret == 0, but there's
no real harm if they do, so we don't stop them.
Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Diffstat (limited to 'arch/powerpc/kernel/rtas.c')
| -rw-r--r-- | arch/powerpc/kernel/rtas.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c index 28736ff27fea..8da209fdf480 100644 --- a/arch/powerpc/kernel/rtas.c +++ b/arch/powerpc/kernel/rtas.c @@ -1070,7 +1070,7 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs) nret = be32_to_cpu(args.nret); token = be32_to_cpu(args.token); - if (nargs > ARRAY_SIZE(args.args) + if (nargs >= ARRAY_SIZE(args.args) || nret > ARRAY_SIZE(args.args) || nargs + nret > ARRAY_SIZE(args.args)) return -EINVAL; |