summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorCliff Wickman <cpw@sgi.com>2008-06-20 12:02:00 -0700
committerTony Luck <tony.luck@intel.com>2008-06-20 12:02:00 -0700
commite0c6d97c65e0784aade7e97b9411f245a6c543e7 (patch)
treedd860efd59feb48050598035301628b79b5b954f
parent9bedbcb207ed9a571b239231d99c8fd4a34ae24d (diff)
downloadlinux-stable-e0c6d97c65e0784aade7e97b9411f245a6c543e7.tar.gz
linux-stable-e0c6d97c65e0784aade7e97b9411f245a6c543e7.tar.bz2
linux-stable-e0c6d97c65e0784aade7e97b9411f245a6c543e7.zip
[IA64] SN2: security hole in sn2_ptc_proc_write
Security hole in sn2_ptc_proc_write It is possible to overrun a buffer with a write to this /proc file. Signed-off-by: Cliff Wickman <cpw@sgi.com> Signed-off-by: Tony Luck <tony.luck@intel.com>
-rw-r--r--arch/ia64/sn/kernel/sn2/sn2_smp.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/arch/ia64/sn/kernel/sn2/sn2_smp.c b/arch/ia64/sn/kernel/sn2/sn2_smp.c
index 49d3120415eb..6dd886c5d860 100644
--- a/arch/ia64/sn/kernel/sn2/sn2_smp.c
+++ b/arch/ia64/sn/kernel/sn2/sn2_smp.c
@@ -512,6 +512,8 @@ static ssize_t sn2_ptc_proc_write(struct file *file, const char __user *user, si
int cpu;
char optstr[64];
+ if (count > sizeof(optstr))
+ return -EINVAL;
if (copy_from_user(optstr, user, count))
return -EFAULT;
optstr[count - 1] = '\0';