Re: [GIT PULL 3/8] KVM: s390: fix get_all_floating_irqs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Mar 31, 2015 at 03:01:58PM +0200, Christian Borntraeger wrote:
> From: Jens Freimann <jfrei@xxxxxxxxxxxxxxxxxx>
> 
> This fixes a bug introduced with commit c05c4186bbe4 ("KVM: s390:
> add floating irq controller").
> 
> get_all_floating_irqs() does copy_to_user() while holding
> a spin lock. Let's fix this by filling a temporary buffer
> first and copy it to userspace after giving up the lock.
> 
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.18+: 69a8d4562638 KVM: s390: no need to hold...
> 
> Reviewed-by: David Hildenbrand <dahi@xxxxxxxxxxxxxxxxxx>
> Signed-off-by: Jens Freimann <jfrei@xxxxxxxxxxxxxxxxxx>
> Signed-off-by: Christian Borntraeger <borntraeger@xxxxxxxxxx>
> Acked-by: Cornelia Huck <cornelia.huck@xxxxxxxxxx>

...

> -static int get_all_floating_irqs(struct kvm *kvm, __u8 *buf, __u64 len)
> +static int get_all_floating_irqs(struct kvm *kvm, __user u8 *usrbuf, u64 len)

fwiw, this is probably the only place within the kernel where we see
"__user u8 *" instead of "u8 __user *". This is odd within this whole
patch.

> +		if (copy_to_user((void __user *) usrbuf,

The cast shouldn't be necessary at all...

--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]