e1dc8904b3
commit 502585c7555083d4a949c08350306b9ec196779e upstream. regs_set() and regs_get() are vulnerable to an off-by-1 buffer overrun if CONFIG_CPU_H8S is set, since this adds an extra entry to register_offset[] but not to user_regs_struct. So, iterate over user_regs_struct based on its actual size, not based on the length of register_offset[]. Signed-off-by: Dave Martin <Dave.Martin@arm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| asm-offsets.c | ||
| dma.c | ||
| entry.S | ||
| h8300_ksyms.c | ||
| head_ram.S | ||
| head_rom.S | ||
| irq.c | ||
| Makefile | ||
| module.c | ||
| process.c | ||
| ptrace.c | ||
| ptrace_h.c | ||
| ptrace_s.c | ||
| setup.c | ||
| signal.c | ||
| sim-console.c | ||
| syscalls.c | ||
| traps.c | ||
| vmlinux.lds.S | ||