nios2: copy_from_user() should zero the tail of destination
authorAl Viro <viro@zeniv.linux.org.uk>
Sat, 20 Aug 2016 20:36:36 +0000 (16:36 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 24 Sep 2016 08:07:45 +0000 (10:07 +0200)
commit e33d1f6f72cc82fcfc3d1fb20c9e3ad83b1928fa upstream.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/nios2/include/asm/uaccess.h

index ebac5bbfc340d435fe31132fd58cb27121ad13bc..0ab82324c8174559ddd478aa0a2dd171b652b8c0 100644 (file)
@@ -102,9 +102,12 @@ extern long __copy_to_user(void __user *to, const void *from, unsigned long n);
 static inline long copy_from_user(void *to, const void __user *from,
                                unsigned long n)
 {
-       if (!access_ok(VERIFY_READ, from, n))
-               return n;
-       return __copy_from_user(to, from, n);
+       unsigned long res = n;
+       if (access_ok(VERIFY_READ, from, n))
+               res = __copy_from_user(to, from, n);
+       if (unlikely(res))
+               memset(to + (n - res), 0, res);
+       return res;
 }
 
 static inline long copy_to_user(void __user *to, const void *from,