github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/drivers/s390/char
History
Gerald Schaefer 2995ccec26 s390/monwriter: Reject buffer reuse with different data length 
When data buffers are reused, e.g. for interval sample records, the
first record determines the data length, and the size of the buffer for
user copy. Current monwriter code does not check if the data length was
changed for subsequent records, which also would never happen for valid
user programs.

However, a malicious user could change the data length, resulting in out
of bounds user copy to the kernel buffer, and memory corruption. By
default, the monwriter misc device is created with root-only permissions,
so practical impact is typically low.

Fix this by checking for changed data length and rejecting such records.

Cc: stable@vger.kernel.org
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-02 16:51:06 +02:00
..
con3215.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
con3270.c s390/con3270: Replace __get_free_page() with kmalloc() 2026-06-03 15:32:44 +02:00
ctrlchar.c s390/ctrlchar: fix kernel doc comment 2021-09-07 13:38:42 +02:00
ctrlchar.h
defkeymap.c
defkeymap.map
diag_ftp.c s390: Remove KMSG_COMPONENT macro 2025-11-24 11:45:21 +01:00
diag_ftp.h
fs3270.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hmcdrv_cache.c s390: Remove KMSG_COMPONENT macro 2025-11-24 11:45:21 +01:00
hmcdrv_cache.h
hmcdrv_dev.c s390/hmcdrv: Remove commented out code 2026-04-02 12:06:29 +02:00
hmcdrv_dev.h
hmcdrv_ftp.c s390: Remove KMSG_COMPONENT macro 2025-11-24 11:45:21 +01:00
hmcdrv_ftp.h
hmcdrv_mod.c s390: Remove KMSG_COMPONENT macro 2025-11-24 11:45:21 +01:00
Kconfig s390/sclp: Remove SCLP_OFB Kconfig option 2026-04-28 14:45:02 +02:00
keyboard.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
keyboard.h tty: the rest, stop using tty_schedule_flip() 2021-11-25 18:35:23 +01:00
Makefile s390/tape: Consolidate tape config options and modules 2026-02-05 13:02:48 +01:00
monreader.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
monwriter.c s390/monwriter: Reject buffer reuse with different data length 2026-07-02 16:51:06 +02:00
raw3270.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
raw3270.h s390/raw3270: make class3270 constant 2024-03-13 09:23:50 +01:00
sclp_ap.c s390: Remove KMSG_COMPONENT macro 2025-11-24 11:45:21 +01:00
sclp_cmd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sclp_con.c treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
sclp_config.c s390/sclp: Remove SCLP_OFB Kconfig option 2026-04-28 14:45:02 +02:00
sclp_cpi_sys.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sclp_cpi_sys.h
sclp_ctl.c s390: Remove compat support 2025-11-17 11:10:38 +01:00
sclp_diag.h
sclp_early_core.c s390: Remove superfluous newlines from inline assemblies 2025-09-29 13:52:08 +02:00
sclp_early.c s390/sclp: Detect ASTFLEIE 2 facility 2026-06-12 15:13:22 +02:00
sclp_ftp.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sclp_ftp.h
sclp_mem.c drivers/base/memory: make memory block get/put explicit 2026-06-02 15:22:12 -07:00
sclp_ocf.c s390: Remove KMSG_COMPONENT macro 2025-11-24 11:45:21 +01:00
sclp_pci.c s390/sclp: Allow user-space to provide PCI reports for NVMe SMART data 2026-05-06 13:18:17 +02:00
sclp_quiesce.c s390/sclp: Remove quiesce power management support 2021-06-18 16:41:20 +02:00
sclp_rw.c TTY / Serial patches for 5.14-rc1 2021-07-05 14:08:24 -07:00
sclp_rw.h TTY / Serial patches for 5.14-rc1 2021-07-05 14:08:24 -07:00
sclp_sd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sclp_sdias.c s390: Remove KMSG_COMPONENT macro 2025-11-24 11:45:21 +01:00
sclp_sdias.h
sclp_tty.c s390/tty: Fix a potential memory leak bug 2025-03-04 17:18:08 +01:00
sclp_tty.h
sclp_vt220.c s390/sclp: Remove unused sclp_vt220_buffered_chars variable 2026-05-26 08:15:40 +02:00
sclp.c s390/sclp: Fix SCCB present check 2025-08-20 16:37:27 +02:00
sclp.h s390: Use inline qualifier for all EX_TABLE and ALTERNATIVE inline assemblies 2025-03-18 17:13:51 +01:00
tape_3490.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
tape_char.c s390/tape: Remove tape load display support 2026-02-04 08:31:29 +01:00
tape_class.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
tape_class.h s390/tape: Consolidate tape config options and modules 2026-02-05 13:02:48 +01:00
tape_core.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
tape_proc.c s390: Remove KMSG_COMPONENT macro 2025-11-24 11:45:21 +01:00
tape_std.c s390/tape: Remove tape load display support 2026-02-04 08:31:29 +01:00
tape_std.h s390/tape: Remove 3480 tape device type 2026-02-04 08:31:30 +01:00
tape.h s390/tape: Consolidate tape config options and modules 2026-02-05 13:02:48 +01:00
uvdevice.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmcp.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmlogrdr.c s390: Remove KMSG_COMPONENT macro 2025-11-24 11:45:21 +01:00
vmur.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmur.h s390/vmur: generate uevent on unsolicited device end 2022-10-10 10:15:10 +02:00
zcore.c s390/zcore: Use octal permission 2026-05-26 08:15:40 +02:00