aboutsummaryrefslogtreecommitdiffstats
path: root/arch/powerpc/kernel/rtas.c
diff options
context:
space:
mode:
authorNathan Fontenot <nfont@austin.ibm.com>2008-07-31 02:23:27 +1000
committerPaul Mackerras <paulus@samba.org>2008-08-11 10:09:56 +1000
commitb79998fc2e1144919b6b02acbd407a5db1f80ac0 (patch)
treed35e2e7a3ece9c16a73d1fc7f9da00912469f06c /arch/powerpc/kernel/rtas.c
parent9ea7d5ad84d61a4e8b892d5ed12ccc26f9d6351b (diff)
downloadkernel_samsung_smdk4412-b79998fc2e1144919b6b02acbd407a5db1f80ac0.zip
kernel_samsung_smdk4412-b79998fc2e1144919b6b02acbd407a5db1f80ac0.tar.gz
kernel_samsung_smdk4412-b79998fc2e1144919b6b02acbd407a5db1f80ac0.tar.bz2
powerpc: Zero fill the return values of rtas argument buffer
The kernel copy of the rtas args struct contains the return value(s) for the specified rtas call. These are copied back to user space with the assumption that every value has been set by the rtas call, which turns out to be not always true. Thus userspace can see random values and think the call failed when in fact it succeeded, but for some reason didn't set one of the return values. This fixes the problem by zeroing out the return value fields of the rtas args struct before processing the rtas call. Signed-off-by: Nathan Fontenot <nfont@austin.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Diffstat (limited to 'arch/powerpc/kernel/rtas.c')
-rw-r--r--arch/powerpc/kernel/rtas.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index c680f1b..1f8505c 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -792,6 +792,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs)
if (args.token == RTAS_UNKNOWN_SERVICE)
return -EINVAL;
+ args.rets = &args.args[nargs];
+ memset(args.rets, 0, args.nret * sizeof(rtas_arg_t));
+
/* Need to handle ibm,suspend_me call specially */
if (args.token == ibm_suspend_me_token) {
rc = rtas_ibm_suspend_me(&args);
@@ -808,8 +811,6 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs)
enter_rtas(__pa(&rtas.args));
args = rtas.args;
- args.rets = &args.args[nargs];
-
/* A -1 return code indicates that the last command couldn't
be completed due to a hardware error. */
if (args.rets[0] == -1)