um: ubd: Prevent buffer overrun on command completion
authorGabriel Krisman Bertazi <krisman@collabora.com>
Tue, 17 Mar 2020 00:45:06 +0000 (20:45 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 23 Apr 2020 08:36:35 +0000 (10:36 +0200)
commit6ba010ea48563b3a01cbdffb5daf289ee8c76a84
tree4fb3e9ea8b669ac87d22791d8e99042bcc3db9e4
parentb9f88c31b266475305d624c109167f5d3e113231
um: ubd: Prevent buffer overrun on command completion

[ Upstream commit 6e682d53fc1ef73a169e2a5300326cb23abb32ee ]

On the hypervisor side, when completing commands and the pipe is full,
we retry writing only the entries that failed, by offsetting
io_req_buffer, but we don't reduce the number of bytes written, which
can cause a buffer overrun of io_req_buffer, and write garbage to the
pipe.

Cc: Martyn Welch <martyn.welch@collabora.com>
Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
arch/um/drivers/ubd_kern.c