[PATCH 3.2 034/126] s390/con3270: fix use of uninitialised data

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.kernel
Subject	[PATCH 3.2 034/126] s390/con3270: fix use of uninitialised data
Date	2017-02-16 01:40 +0100
Message-ID	<tbih5-768-59@gated-at.bofh.it> (permalink)
References	<tbgIi-5XZ-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.2.85-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Sascha Silbe <silbe@linux.vnet.ibm.com>

commit c14f2aac7aa147861793eed9f41f91dd530f0be1 upstream.

con3270 contains an optimisation that reduces the amount of data to be
transmitted to the 3270 terminal by putting a Repeat to Address (RA)
order into the data stream. The RA order itself takes up space, so
con3270 only uses it if there's enough space left in the line
buffer. Otherwise it just pads out the line manually.

For lines too long to include the RA order, one byte was left
uninitialised. This was caused by an off-by-one bug in the loop that
pads out the line. Since the buffer is allocated from a common pool,
the single byte left uninitialised contained some previous buffer
content. Usually this was just a space or some character (which can
result in clutter but is otherwise harmless). Sometimes, however, it
was a Repeat to Address order, messing up the entire screen layout and
causing the display to send the entire buffer content on every
keystroke.

Fixes: f51320a5 ("[PATCH] s390: new 3270 driver.") (tglx/history.git)
Reported-by: Liu Jing <liujbjl@linux.vnet.ibm.com>
Tested-by: Jing Liu <liujbjl@linux.vnet.ibm.com>
Tested-by: Yang Chen <bjcyang@linux.vnet.ibm.com>
Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/s390/char/con3270.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/s390/char/con3270.c
+++ b/drivers/s390/char/con3270.c
@@ -456,7 +456,7 @@ con3270_cline_end(struct con3270 *cp)
 		s->string[s->len - 4] = TO_RA;
 		s->string[s->len - 1] = 0;
 	} else {
-		while (--size > cp->cline->len)
+		while (--size >= cp->cline->len)
 			s->string[size] = cp->view.ascebc[' '];
 	}
 	/* Replace cline with allocated line s and reset cline. */

Thread

[PATCH 3.2 000/126] 3.2.85-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 111/126] lockdep: Silence warning if CONFIG_LOCKDEP  isn't set Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 095/126] locking/rtmutex: Prevent dequeue vs. unlock race Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 057/126] scsi: arcmsr: Send SYNCHRONIZE_CACHE command  to firmware Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 110/126] perf: Fix perf_event_for_each() to use sibling Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 098/126] net: ping: check minimum size on ICMP header  length Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 114/126] perf/core: Fix concurrent sys_perf_event_open()  vs. 'move_group' race Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
    Re: [PATCH 3.2 114/126] perf/core: Fix concurrent  sys_perf_event_open() vs. 'move_group' race Ben Hutchings <ben@decadent.org.uk> - 2017-02-21 01:50 +0100
  [PATCH 3.2 085/126] Fix USB CB/CBI storage devices with  CONFIG_VMAP_STACK=y Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 124/126] sg_write()/bsg_write() is not fit to be  called under KERNEL_DS Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 053/126] scsi: megaraid_sas: Fix data integrity  failure for JBOD (passthrough) devices Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 112/126] perf: Fix event->ctx locking Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 089/126] IB/uverbs: Fix leak of XRC target QPs Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 037/126] fuse: fix killing s[ug]id in setattr Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 026/126] net/mlx4_core: Fix deadlock when switching  between polling and event fw commands Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 047/126] ubifs: Abort readdir upon error Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 003/126] zfcp: fix ELS/GS request&response length for  hardware data router Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 065/126] ubifs: Fix regression in ubifs_readdir() Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 046/126] ubifs: Fix xattr_names length in exit paths Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 039/126] crypto: gcm - Fix IV buffer size in  crypto_gcm_setkey Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 015/126] [media] mb86a20s: fix the locking logic Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 049/126] batman-adv: fix splat on disabling an interface Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
    Re: [PATCH 3.2 049/126] batman-adv: fix splat on disabling an  interface Linus Lüssing <linus.luessing@c0d3.blue> - 2017-02-16 08:00 +0100
      Re: [PATCH 3.2 049/126] batman-adv: fix splat on disabling an  interface Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 17:10 +0100
  [PATCH 3.2 005/126] zfcp: retain trace level for SCSI and HBA FSF  response records Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 032/126] powerpc/vdso64: Use double word compare on  pointers Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 027/126] ALSA: usb-audio: Extend DragonFly dB scale  quirk to cover other variants Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 061/126] vt: clear selection before resizing Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 040/126] powerpc/64: Fix incorrect return value from  __copy_tofrom_user Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 044/126] isofs: Do not return EACCES for unknown  filesystems Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 030/126] USB: serial: cp210x: Add ID for a Juniper console Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 034/126] s390/con3270: fix use of uninitialised data Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 016/126] [media] cx231xx: don't return error on success Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 033/126] ext4: release bh in make_indexed_dir Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 035/126] s390/con3270: fix insufficient space padding Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 024/126] ALSA: ali5451: Fix out-of-bound position  reporting Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 010/126] zfcp: fix payload trace length for SAN  request&response Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 028/126] regulator: tps65910: Work around silicon  erratum SWCZ010 Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 008/126] zfcp: restore tracing of handle for port and  LUN with HBA records Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 022/126] scsi: ibmvfc: Fix I/O hang when port is not  mapped Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 004/126] zfcp: close window with unblocked rport  during rport gone Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 017/126] [media] cx231xx: fix GPIOs for Pixelview  SBTVD hybrid Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 029/126] mmc: block: don't use CMD23 with very old MMC  cards Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 014/126] rtlwifi: Fix missing country code for Great  Britain Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 011/126] zfcp: trace full payload of all SAN records  (req,resp,iels) Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 002/126] zfcp: fix fc_host port_type with NPIV Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 013/126] rtlwifi: Update regulatory database Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 006/126] zfcp: restore: Dont use 0 to indicate invalid  LUN in rec trace Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 009/126] zfcp: fix D_ID field with actual value on  tracing SAN responses Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 025/126] usb: misc: legousbtower: Fix NULL pointer  deference Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 038/126] fuse: listxattr: verify xattr list Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 043/126] scsi: zfcp: spin_lock_irqsave() is not nestable Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 036/126] fuse: invalidate dir dentry after chmod Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 019/126] reiserfs: Unlock superblock before calling  reiserfs_quota_on_mount() Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  Re: [PATCH 3.2 000/126] 3.2.85-rc1 review Guenter Roeck <linux@roeck-us.net> - 2017-02-16 07:10 +0100
    Re: [PATCH 3.2 000/126] 3.2.85-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 17:00 +0100

csiph-web