diff options
| author | Amit Shah <amit.shah@redhat.com> | 2010-09-14 13:26:16 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-09-26 17:18:20 -0700 |
| commit | d4f5d4c1a4f45e69deb3bcf727e511b0637a72d1 (patch) | |
| tree | f5bb3677a4e7dfd2c1946edb7d40f2c702c7f60d | |
| parent | d987d040e9623502a97a9dd742377d4ec00e2ba2 (diff) | |
| download | kernel-crypto-d4f5d4c1a4f45e69deb3bcf727e511b0637a72d1.tar.gz kernel-crypto-d4f5d4c1a4f45e69deb3bcf727e511b0637a72d1.tar.xz kernel-crypto-d4f5d4c1a4f45e69deb3bcf727e511b0637a72d1.zip | |
virtio: console: Prevent userspace from submitting NULL buffers
commit 65745422a898741ee0e7068ef06624ab06e8aefa upstream.
A userspace could submit a buffer with 0 length to be written to the
host. Prevent such a situation.
This was not needed previously, but recent changes in the way write()
works exposed this condition to trigger a virtqueue event to the host,
causing a NULL buffer to be sent across.
Signed-off-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/char/virtio_console.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index 942a9826bd2..56ffd0d93e2 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -596,6 +596,10 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf, ssize_t ret; bool nonblock; + /* Userspace could be out to fool us */ + if (!count) + return 0; + port = filp->private_data; nonblock = filp->f_flags & O_NONBLOCK; |