um: ubd: Prevent buffer overrun on command completion

On the hypervisor side, when completing commands and the pipe is full,
we retry writing only the entries that failed, by offsetting
io_req_buffer, but we don't reduce the number of bytes written, which
can cause a buffer overrun of io_req_buffer, and write garbage to the
pipe.

Cc: Martyn Welch <martyn.welch@collabora.com>
Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 247f95da057b598399ce9170c83f45db5070a2f6..eca45ad2166c9e61ed5882f72598752bd653e893 100644 (file)
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -1607,7 +1607,9 @@ int io_thread(void *arg)
                written = 0;
 
                do {
-                       res = os_write_file(kernel_fd, ((char *) io_req_buffer) + written, n);
+                       res = os_write_file(kernel_fd,
+                                           ((char *) io_req_buffer) + written,
+                                           n - written);
                        if (res >= 0) {
                                written += res;
                        }