uml: check length in exitcode_proc_write()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 29 Oct 2013 19:06:04 +0000 (19:06 +0000)
committerWilly Tarreau <w@1wt.eu>
Mon, 19 May 2014 05:54:32 +0000 (07:54 +0200)
commit4b500c7ff030f35aa6f8badf2f243bc259021e39
treeb91b4034fe616c0ab095566918d627af299f3553
parenta35f8f7b89f6c91bae8aa46507556de4185e9e7a
uml: check length in exitcode_proc_write()

commit 201f99f170df14ba52ea4c52847779042b7a623b upstream

We don't cap the size of buffer from the user so we could write past the
end of the array here.  Only root can write to this file.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
arch/um/kernel/exitcode.c