[SPARC]: Fix length parameter verification in sys_getdomainname().
Found by scrashme. Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
@@ -465,21 +465,21 @@ sys_rt_sigaction(int sig,
|
|||||||
|
|
||||||
asmlinkage int sys_getdomainname(char __user *name, int len)
|
asmlinkage int sys_getdomainname(char __user *name, int len)
|
||||||
{
|
{
|
||||||
int nlen;
|
int nlen, err;
|
||||||
int err = -EFAULT;
|
|
||||||
|
if (len < 0 || len > __NEW_UTS_LEN)
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
down_read(&uts_sem);
|
down_read(&uts_sem);
|
||||||
|
|
||||||
nlen = strlen(system_utsname.domainname) + 1;
|
nlen = strlen(system_utsname.domainname) + 1;
|
||||||
|
|
||||||
if (nlen < len)
|
if (nlen < len)
|
||||||
len = nlen;
|
len = nlen;
|
||||||
if (len > __NEW_UTS_LEN)
|
|
||||||
goto done;
|
err = -EFAULT;
|
||||||
if (copy_to_user(name, system_utsname.domainname, len))
|
if (!copy_to_user(name, system_utsname.domainname, len))
|
||||||
goto done;
|
|
||||||
err = 0;
|
err = 0;
|
||||||
done:
|
|
||||||
up_read(&uts_sem);
|
up_read(&uts_sem);
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
@@ -701,21 +701,21 @@ extern void check_pending(int signum);
|
|||||||
|
|
||||||
asmlinkage long sys_getdomainname(char __user *name, int len)
|
asmlinkage long sys_getdomainname(char __user *name, int len)
|
||||||
{
|
{
|
||||||
int nlen;
|
int nlen, err;
|
||||||
int err = -EFAULT;
|
|
||||||
|
if (len < 0 || len > __NEW_UTS_LEN)
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
down_read(&uts_sem);
|
down_read(&uts_sem);
|
||||||
|
|
||||||
nlen = strlen(system_utsname.domainname) + 1;
|
nlen = strlen(system_utsname.domainname) + 1;
|
||||||
|
|
||||||
if (nlen < len)
|
if (nlen < len)
|
||||||
len = nlen;
|
len = nlen;
|
||||||
if (len > __NEW_UTS_LEN)
|
|
||||||
goto done;
|
err = -EFAULT;
|
||||||
if (copy_to_user(name, system_utsname.domainname, len))
|
if (!copy_to_user(name, system_utsname.domainname, len))
|
||||||
goto done;
|
|
||||||
err = 0;
|
err = 0;
|
||||||
done:
|
|
||||||
up_read(&uts_sem);
|
up_read(&uts_sem);
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
Reference in New Issue
Block a user