powerpc/powernv: Check sysfs size before copying
authorJoel Stanley <joel@jms.id.au>
Thu, 24 Apr 2014 07:25:35 +0000 (16:55 +0930)
committerBenjamin Herrenschmidt <benh@kernel.crashing.org>
Mon, 28 Apr 2014 03:08:48 +0000 (13:08 +1000)
The sysparam code currently uses the userspace supplied number of
bytes when memcpy()ing in to a local 64-byte buffer.

Limit the maximum number of bytes by the size of the buffer.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
arch/powerpc/platforms/powernv/opal-sysparam.c

index 0675e1a90b40bc821f8b5dea94336d7de29b6d65..83f5f2a1c5639929391f97a2f037ba5660d42296 100644 (file)
@@ -135,6 +135,10 @@ static ssize_t sys_param_store(struct kobject *kobj,
                        kobj_attr);
        ssize_t ret;
 
+        /* MAX_PARAM_DATA_LEN is sizeof(param_data_buf) */
+        if (count > MAX_PARAM_DATA_LEN)
+                count = MAX_PARAM_DATA_LEN;
+
        mutex_lock(&opal_sysparam_mutex);
        memcpy(param_data_buf, buf, count);
        ret = opal_set_sys_param(attr->param_id, attr->param_size,