Skip to content

Commit a2aec0d

Browse files
heicarstMartin Schwidefsky
authored andcommitted
s390/compat: fix compat_sys_statfs() memory corruption
The f_spare field within struct compat_statfs is four bytes larger than within the native 31 bit struct statfs. compat_sys_statfs() clears the f_spare field in user space which means that in compat mode four bytes that are behind the user space supplied struct compat_statfs will be corrupted (zeroed). According to Thomas Gleixner's Linux 2.6 history tree this bug is present since v2.5.74 87880da124 "[PATCH] s390: 31 bit compat.". So it get's fixed shortly before its 10th anniversary. Tough luck. Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
1 parent 241fd9b commit a2aec0d

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

arch/s390/include/asm/compat.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ struct compat_statfs {
135135
s32 f_namelen;
136136
s32 f_frsize;
137137
s32 f_flags;
138-
s32 f_spare[5];
138+
s32 f_spare[4];
139139
};
140140

141141
#define COMPAT_RLIM_OLD_INFINITY 0x7fffffff

0 commit comments

Comments
 (0)