X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=arch%2Fparisc%2Fhpux%2Fsys_hpux.c;h=2ef63ba4881e39d44d014c3584238030d4c4a3b0;hb=43bc926fffd92024b46cafaf7350d669ba9ca884;hp=a64fd48fbfb5625d6cb4741bf0237ea8eb79c2a0;hpb=cee37fe97739d85991964371c1f3a745c00dd236;p=linux-2.6.git

diff --git a/arch/parisc/hpux/sys_hpux.c b/arch/parisc/hpux/sys_hpux.c
index a64fd48fb..2ef63ba48 100644
--- a/arch/parisc/hpux/sys_hpux.c
+++ b/arch/parisc/hpux/sys_hpux.c
@@ -22,6 +22,7 @@
  *    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+#include <linux/capability.h>
 #include <linux/file.h>
 #include <linux/fs.h>
 #include <linux/namei.h>
@@ -32,6 +33,7 @@
 #include <linux/utsname.h>
 #include <linux/vfs.h>
 #include <linux/vmalloc.h>
+#include <linux/vs_cvirt.h>
 
 #include <asm/errno.h>
 #include <asm/pgalloc.h>
@@ -265,15 +267,15 @@ static int hpux_uname(struct hpux_utsname *name)
 
 	down_read(&uts_sem);
 
-	error = __copy_to_user(&name->sysname,&system_utsname.sysname,HPUX_UTSLEN-1);
+	error = __copy_to_user(&name->sysname,vx_new_uts(sysname),HPUX_UTSLEN-1);
 	error |= __put_user(0,name->sysname+HPUX_UTSLEN-1);
-	error |= __copy_to_user(&name->nodename,&system_utsname.nodename,HPUX_UTSLEN-1);
+	error |= __copy_to_user(&name->nodename,vx_new_uts(nodename),HPUX_UTSLEN-1);
 	error |= __put_user(0,name->nodename+HPUX_UTSLEN-1);
-	error |= __copy_to_user(&name->release,&system_utsname.release,HPUX_UTSLEN-1);
+	error |= __copy_to_user(&name->release,vx_new_uts(release),HPUX_UTSLEN-1);
 	error |= __put_user(0,name->release+HPUX_UTSLEN-1);
-	error |= __copy_to_user(&name->version,&system_utsname.version,HPUX_UTSLEN-1);
+	error |= __copy_to_user(&name->version,vx_new_uts(version),HPUX_UTSLEN-1);
 	error |= __put_user(0,name->version+HPUX_UTSLEN-1);
-	error |= __copy_to_user(&name->machine,&system_utsname.machine,HPUX_UTSLEN-1);
+	error |= __copy_to_user(&name->machine,vx_new_uts(machine),HPUX_UTSLEN-1);
 	error |= __put_user(0,name->machine+HPUX_UTSLEN-1);
 
 	up_read(&uts_sem);
@@ -372,8 +374,8 @@ int hpux_utssys(char *ubuf, int n, int type)
 		/*  TODO:  print a warning about using this?  */
 		down_write(&uts_sem);
 		error = -EFAULT;
-		if (!copy_from_user(system_utsname.sysname, ubuf, len)) {
-			system_utsname.sysname[len] = 0;
+		if (!copy_from_user(vx_new_uts(sysname), ubuf, len)) {
+			vx_new_uts(sysname)[len] = 0;
 			error = 0;
 		}
 		up_write(&uts_sem);
@@ -399,8 +401,8 @@ int hpux_utssys(char *ubuf, int n, int type)
 		/*  TODO:  print a warning about this?  */
 		down_write(&uts_sem);
 		error = -EFAULT;
-		if (!copy_from_user(system_utsname.release, ubuf, len)) {
-			system_utsname.release[len] = 0;
+		if (!copy_from_user(vx_new_uts(release), ubuf, len)) {
+			vx_new_uts(release)[len] = 0;
 			error = 0;
 		}
 		up_write(&uts_sem);
@@ -421,13 +423,13 @@ int hpux_getdomainname(char *name, int len)
  	
  	down_read(&uts_sem);
  	
-	nlen = strlen(system_utsname.domainname) + 1;
+	nlen = strlen(vx_new_uts(domainname)) + 1;
 
 	if (nlen < len)
 		len = nlen;
 	if(len > __NEW_UTS_LEN)
 		goto done;
-	if(copy_to_user(name, system_utsname.domainname, len))
+	if(copy_to_user(name, vx_new_uts(domainname), len))
 		goto done;
 	err = 0;
 done:
@@ -467,19 +469,23 @@ int hpux_sysfs(int opcode, unsigned long arg1, unsigned long arg2)
 	if ( opcode == 1 ) { /* GETFSIND */	
 		len = strlen_user((char *)arg1);
 		printk(KERN_DEBUG "len of arg1 = %d\n", len);
-
-		fsname = (char *) kmalloc(len+1, GFP_KERNEL);
+		if (len == 0)
+			return 0;
+		fsname = (char *) kmalloc(len, GFP_KERNEL);
 		if ( !fsname ) {
 			printk(KERN_DEBUG "failed to kmalloc fsname\n");
 			return 0;
 		}
 
-		if ( copy_from_user(fsname, (char *)arg1, len+1) ) {
+		if ( copy_from_user(fsname, (char *)arg1, len) ) {
 			printk(KERN_DEBUG "failed to copy_from_user fsname\n");
 			kfree(fsname);
 			return 0;
 		}
 
+		/* String could be altered by userspace after strlen_user() */
+		fsname[len] = '\0';
+
 		printk(KERN_DEBUG "that is '%s' as (char *)\n", fsname);
 		if ( !strcmp(fsname, "hfs") ) {
 			fstype = 0;