3a158a62da
The metag implementation of strncpy_from_user() doesn't validate the src pointer, which could allow reading of arbitrary kernel memory. Add a short access_ok() check to prevent that. Its still possible for it to read across the user/kernel boundary, but it will invariably reach a NUL character after only 9 bytes, leaking only a static kernel address being loaded into D0Re0 at the beginning of __start, which is acceptable for the immediate fix. Reported-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: linux-metag@vger.kernel.org Cc: stable@vger.kernel.org |
||
|---|---|---|
| .. | ||
| boot | ||
| configs | ||
| include | ||
| kernel | ||
| lib | ||
| mm | ||
| oprofile | ||
| tbx | ||
| Kconfig | ||
| Kconfig.debug | ||
| Kconfig.soc | ||
| Makefile | ||