Unverified Commit 0086af96 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5253 tomoyo: fix UAF write bug in tomoyo_write_control() 

Merge Pull Request from: @ci-robot 
 
PR sync from: felix <fuzhen5@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/LOK47VQCYFCVXADJVCBMJOQFDFFCEKPW/ 
 
https://gitee.com/src-openeuler/kernel/issues/I95LPF 
 
Link:https://gitee.com/openeuler/kernel/pulls/5253

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents aab1f2b8 b1af7a4f

security/tomoyo/common.c

+2 −1
Original line number Diff line number Diff line
@@ -2657,13 +2657,14 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, 
{

	int error = buffer_len;

	size_t avail_len = buffer_len;

	char *cp0 = head->write_buf;

	char *cp0;

	int idx;



	if (!head->write)

		return -EINVAL;

	if (mutex_lock_interruptible(&head->io_sem))

		return -EINTR;

	cp0 = head->write_buf;

	head->read_user_buf_avail = 0;

	idx = tomoyo_read_lock();

	/* Read a line and dispatch it to the policy handler. */