Re: [PATCH v2] s390/monwriter: Reject buffer reuse with different data length

[Christian Borntraeger <borntraeger@linux.ibm.com>]

Am 23.06.26 um 19:44 schrieb Gerald Schaefer:
> When data buffers are reused, e.g. for interval sample records, the
> first record determines the data length, and the size of the buffer for
> user copy. Current monwriter code does not check if the data length was
> changed for subsequent records, which also would never happen for valid
> user programs.
> 
> However, a malicious user could change the data length, resulting in out
> of bounds user copy to the kernel buffer, and memory corruption. By
> default, the monwriter misc device is created with root-only permissions,
> so practical impact is typically low.
> 
> Fix this by checking for changed data length and rejecting such records.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>

Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>