korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-15 16:24:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

um: ubd: Prevent buffer overrun on command completion

Browse Source 
On the hypervisor side, when completing commands and the pipe is full,
we retry writing only the entries that failed, by offsetting
io_req_buffer, but we don't reduce the number of bytes written, which
can cause a buffer overrun of io_req_buffer, and write garbage to the
pipe.

Cc: Martyn Welch <martyn.welch@collabora.com>
Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
This commit is contained in:
Gabriel Krisman Bertazi 2020-03-16 20:45:06 -04:00 committed by Richard Weinberger
parent 598f563036
commit 6e682d53fc
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
arch/um/drivers/ubd_kern.c
View File

@ -1607,7 +1607,9 @@ int io_thread(void *arg)
written = 0;
do {
res = os_write_file(kernel_fd, ((char *) io_req_buffer) + written, n);
res = os_write_file(kernel_fd,
((char *) io_req_buffer) + written,
n - written);
if (res >= 0) {
written += res;
}