diff options
author | Robert Richter <robert.richter@amd.com> | 2012-07-19 12:28:26 -0400 |
---|---|---|
committer | Robert Richter <robert.richter@amd.com> | 2012-08-27 08:49:23 -0400 |
commit | 81ff3478d9ba7f0b48b0abef740e542fd83adf79 (patch) | |
tree | 46e7dcdba46426a298893946664003fe44d5bda3 | |
parent | fea7a08acb13524b47711625eebea40a0ede69a0 (diff) |
oprofile, s390: Fix uninitialized memory access when writing to oprofilefs
If oprofilefs_ulong_from_user() is called with count equals zero, *val
remains unchanged. Depending on the implementation it might be
uninitialized. Fixing users of oprofilefs_ulong_ from_user().
We missed these s390 changes with:
913050b oprofile: Fix uninitialized memory access when writing to writing to oprofilefs
Cc: stable@vger.kernel.org # 3.3+
Signed-off-by: Robert Richter <robert.richter@amd.com>
-rw-r--r-- | arch/s390/oprofile/init.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c index a1e9d69a9c90..584b93674ea4 100644 --- a/arch/s390/oprofile/init.c +++ b/arch/s390/oprofile/init.c | |||
@@ -169,7 +169,7 @@ static ssize_t hw_interval_write(struct file *file, char const __user *buf, | |||
169 | if (*offset) | 169 | if (*offset) |
170 | return -EINVAL; | 170 | return -EINVAL; |
171 | retval = oprofilefs_ulong_from_user(&val, buf, count); | 171 | retval = oprofilefs_ulong_from_user(&val, buf, count); |
172 | if (retval) | 172 | if (retval <= 0) |
173 | return retval; | 173 | return retval; |
174 | if (val < oprofile_min_interval) | 174 | if (val < oprofile_min_interval) |
175 | oprofile_hw_interval = oprofile_min_interval; | 175 | oprofile_hw_interval = oprofile_min_interval; |
@@ -212,7 +212,7 @@ static ssize_t hwsampler_zero_write(struct file *file, char const __user *buf, | |||
212 | return -EINVAL; | 212 | return -EINVAL; |
213 | 213 | ||
214 | retval = oprofilefs_ulong_from_user(&val, buf, count); | 214 | retval = oprofilefs_ulong_from_user(&val, buf, count); |
215 | if (retval) | 215 | if (retval <= 0) |
216 | return retval; | 216 | return retval; |
217 | if (val != 0) | 217 | if (val != 0) |
218 | return -EINVAL; | 218 | return -EINVAL; |
@@ -243,7 +243,7 @@ static ssize_t hwsampler_kernel_write(struct file *file, char const __user *buf, | |||
243 | return -EINVAL; | 243 | return -EINVAL; |
244 | 244 | ||
245 | retval = oprofilefs_ulong_from_user(&val, buf, count); | 245 | retval = oprofilefs_ulong_from_user(&val, buf, count); |
246 | if (retval) | 246 | if (retval <= 0) |
247 | return retval; | 247 | return retval; |
248 | 248 | ||
249 | if (val != 0 && val != 1) | 249 | if (val != 0 && val != 1) |
@@ -278,7 +278,7 @@ static ssize_t hwsampler_user_write(struct file *file, char const __user *buf, | |||
278 | return -EINVAL; | 278 | return -EINVAL; |
279 | 279 | ||
280 | retval = oprofilefs_ulong_from_user(&val, buf, count); | 280 | retval = oprofilefs_ulong_from_user(&val, buf, count); |
281 | if (retval) | 281 | if (retval <= 0) |
282 | return retval; | 282 | return retval; |
283 | 283 | ||
284 | if (val != 0 && val != 1) | 284 | if (val != 0 && val != 1) |
@@ -317,7 +317,7 @@ static ssize_t timer_enabled_write(struct file *file, char const __user *buf, | |||
317 | return -EINVAL; | 317 | return -EINVAL; |
318 | 318 | ||
319 | retval = oprofilefs_ulong_from_user(&val, buf, count); | 319 | retval = oprofilefs_ulong_from_user(&val, buf, count); |
320 | if (retval) | 320 | if (retval <= 0) |
321 | return retval; | 321 | return retval; |
322 | 322 | ||
323 | if (val != 0 && val != 1) | 323 | if (val != 0 && val != 1) |