summaryrefslogtreecommitdiffstats
path: root/arch/um
diff options
context:
space:
mode:
authorGabriel Krisman Bertazi <krisman@collabora.com>2020-03-16 20:45:06 -0400
committerRichard Weinberger <richard@nod.at>2020-03-29 23:21:33 +0200
commit6e682d53fc1ef73a169e2a5300326cb23abb32ee (patch)
treea13449f41b0c5467b26d7e9f9e6b6ab9021e05ce /arch/um
parent598f5630361397c542a0ba2bec0ac5c0e1723d5c (diff)
downloadlinux-6e682d53fc1ef73a169e2a5300326cb23abb32ee.tar.bz2
um: ubd: Prevent buffer overrun on command completion
On the hypervisor side, when completing commands and the pipe is full, we retry writing only the entries that failed, by offsetting io_req_buffer, but we don't reduce the number of bytes written, which can cause a buffer overrun of io_req_buffer, and write garbage to the pipe. Cc: Martyn Welch <martyn.welch@collabora.com> Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com> Signed-off-by: Richard Weinberger <richard@nod.at>
Diffstat (limited to 'arch/um')
-rw-r--r--arch/um/drivers/ubd_kern.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 247f95da057b..eca45ad2166c 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -1607,7 +1607,9 @@ int io_thread(void *arg)
written = 0;
do {
- res = os_write_file(kernel_fd, ((char *) io_req_buffer) + written, n);
+ res = os_write_file(kernel_fd,
+ ((char *) io_req_buffer) + written,
+ n - written);
if (res >= 0) {
written += res;
}