powerpc/pseries/hvconsole: Fix stack overread via udbg

[mirror_ubuntu-bionic-kernel.git] / drivers / tty / hvc / hvc_vio.c

diff --git a/drivers/tty/hvc/hvc_vio.c b/drivers/tty/hvc/hvc_vio.c
index 59eaa620bf13a00ff28f3c3d1902b5a30e63b029..80fd06fbd712a79a7200ee63072846accd38d386 100644 (file)
--- a/drivers/tty/hvc/hvc_vio.c
+++ b/drivers/tty/hvc/hvc_vio.c
@@ -107,6 +107,14 @@ static int hvterm_raw_get_chars(uint32_t vtermno, char *buf, int count)
        return got;
 }
 
+/**
+ * hvterm_raw_put_chars: send characters to firmware for given vterm adapter
+ * @vtermno: The virtual terminal number.
+ * @buf: The characters to send. Because of the underlying hypercall in
+ *       hvc_put_chars(), this buffer must be at least 16 bytes long, even if
+ *       you are sending fewer chars.
+ * @count: number of chars to send.
+ */
 static int hvterm_raw_put_chars(uint32_t vtermno, const char *buf, int count)
 {
        struct hvterm_priv *pv = hvterm_privs[vtermno];
@@ -219,6 +227,7 @@ static const struct hv_ops hvterm_hvsi_ops = {
 static void udbg_hvc_putc(char c)
 {
        int count = -1;
+       unsigned char bounce_buffer[16];
 
        if (!hvterm_privs[0])
                return;
@@ -229,7 +238,12 @@ static void udbg_hvc_putc(char c)
        do {
                switch(hvterm_privs[0]->proto) {
                case HV_PROTOCOL_RAW:
-                       count = hvterm_raw_put_chars(0, &c, 1);
+                       /*
+                        * hvterm_raw_put_chars requires at least a 16-byte
+                        * buffer, so go via the bounce buffer
+                        */
+                       bounce_buffer[0] = c;
+                       count = hvterm_raw_put_chars(0, bounce_buffer, 1);
                        break;
                case HV_PROTOCOL_HVSI:
                        count = hvterm_hvsi_put_chars(0, &c, 1);