tree 3bc98a98c96a419d250e46dc7b0426b73ed65d58
parent 723cacbd9dc79582e562c123a0bacf8bfc69e72a
author Martin Schwidefsky <schwidefsky@de.ibm.com> 1461599668 +0200
committer Martin Schwidefsky <schwidefsky@de.ibm.com> 1461742419 +0200

s390/sclp_ctl: fix potential information leak with /dev/sclp

The sclp_ctl_ioctl_sccb function uses two copy_from_user calls to
retrieve the sclp request from user space. The first copy_from_user
fetches the length of the request which is stored in the first two
bytes of the request. The second copy_from_user gets the complete
sclp request, but this copies the length field a second time.
A malicious user may have changed the length in the meantime.

Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
Reviewed-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>