diff options
Diffstat (limited to '')
| -rw-r--r-- | lib/mpi/mpicoder.c | 3 | ||||
| -rw-r--r-- | lib/notifier-error-inject.c | 2 | ||||
| -rw-r--r-- | lib/test_firmware.c | 1 | ||||
| -rw-r--r-- | lib/usercopy.c | 7 |
4 files changed, 11 insertions, 2 deletions
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c index eead4b339..4f73db248 100644 --- a/lib/mpi/mpicoder.c +++ b/lib/mpi/mpicoder.c @@ -397,7 +397,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) while (sg_miter_next(&miter)) { buff = miter.addr; - len = miter.length; + len = min_t(unsigned, miter.length, nbytes); + nbytes -= len; for (x = 0; x < len; x++) { a <<= 8; diff --git a/lib/notifier-error-inject.c b/lib/notifier-error-inject.c index eb4a04afe..125ea8ce2 100644 --- a/lib/notifier-error-inject.c +++ b/lib/notifier-error-inject.c @@ -14,7 +14,7 @@ static int debugfs_errno_get(void *data, u64 *val) return 0; } -DEFINE_SIMPLE_ATTRIBUTE(fops_errno, debugfs_errno_get, debugfs_errno_set, +DEFINE_SIMPLE_ATTRIBUTE_SIGNED(fops_errno, debugfs_errno_get, debugfs_errno_set, "%lld\n"); static struct dentry *debugfs_create_errno(const char *name, umode_t mode, diff --git a/lib/test_firmware.c b/lib/test_firmware.c index a74b1aae7..f4cc87402 100644 --- a/lib/test_firmware.c +++ b/lib/test_firmware.c @@ -902,6 +902,7 @@ static int __init test_firmware_init(void) rc = misc_register(&test_fw_misc_device); if (rc) { + __test_firmware_config_free(); kfree(test_fw_config); pr_err("could not register misc device: %d\n", rc); return rc; diff --git a/lib/usercopy.c b/lib/usercopy.c index 3744b2a8e..1e99c1baf 100644 --- a/lib/usercopy.c +++ b/lib/usercopy.c @@ -1,5 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 #include <linux/uaccess.h> +#include <linux/nospec.h> /* out-of-line parts */ @@ -9,6 +10,12 @@ unsigned long _copy_from_user(void *to, const void __user *from, unsigned long n unsigned long res = n; might_fault(); if (likely(access_ok(VERIFY_READ, from, n))) { + /* + * Ensure that bad access_ok() speculation will not + * lead to nasty side effects *after* the copy is + * finished: + */ + barrier_nospec(); kasan_check_write(to, n); res = raw_copy_from_user(to, from, n); } |