mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-11-09 12:24:07 -05:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
532c34b5fb
The sclp_ctl_ioctl_sccb function uses two copy_from_user calls to retrieve the sclp request from user space. The first copy_from_user fetches the length of the request which is stored in the first two bytes of the request. The second copy_from_user gets the complete sclp request, but this copies the length field a second time. A malicious user may have changed the length in the meantime. Reported-by: Pengfei Wang <[email protected]> Reviewed-by: Michael Holzheu <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]> |
||
| .. | ||
| block | ||
| char | ||
| cio | ||
| crypto | ||
| net | ||
| scsi | ||
| virtio | ||
| Makefile | ||