linux-kernel - [PATCH v2 1/2] alpha: osf_sys.c: fix put

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20171108150339.1013031-1-arnd@arndb.de>
Date:   Wed,  8 Nov 2017 16:02:13 +0100
From:   Arnd Bergmann <arnd@...db.de>
To:     Richard Henderson <rth@...ddle.net>
Cc:     Ivan Kokshaysky <ink@...assic.park.msu.ru>,
        Matt Turner <mattst88@...il.com>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        y2038@...ts.linaro.org, Deepa Dinamani <deepa.kernel@...il.com>,
        Ben Hutchings <ben@...adent.org.uk>,
        Arnd Bergmann <arnd@...db.de>, stable@...r.kernel.org,
        linux-alpha@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH v2 1/2] alpha: osf_sys.c: fix put_tv32 regression

There was a typo in the new version of put_tv32() that caused an unguarded
access of a user space pointer, and failed to return the correct result in
gettimeofday(), wait4(), usleep_thread() and old_adjtimex().

This fixes it to give the correct behavior again.

Cc: stable@...r.kernel.org
Fixes: 1cc6c4635e9f ("osf_sys.c: switch handling of timeval32/itimerval32 to copy_{to,from}_user()")
Signed-off-by: Arnd Bergmann <arnd@...db.de>
---
v2: fix incorrect changelog description
---
 arch/alpha/kernel/osf_sys.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index ce3a675c0c4b..75a5c35a2067 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -964,8 +964,8 @@ static inline long
 put_tv32(struct timeval32 __user *o, struct timeval *i)
 {
 	return copy_to_user(o, &(struct timeval32){
-				.tv_sec = o->tv_sec,
-				.tv_usec = o->tv_usec},
+				.tv_sec = i->tv_sec,
+				.tv_usec = i->tv_usec},
 			    sizeof(struct timeval32));
 }
 
-- 
2.9.0