nios2: copy_from_user() should zero the tail of destination
authorAl Viro <viro@zeniv.linux.org.uk>
Sat, 20 Aug 2016 20:36:36 +0000 (16:36 -0400)
committerAl Viro <viro@zeniv.linux.org.uk>
Tue, 13 Sep 2016 21:49:43 +0000 (17:49 -0400)
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
arch/nios2/include/asm/uaccess.h

index caa51ff85a3c7d0ac7c57cf034758185aad64724..2b4b9e91967525b722990ba4796324be523a1f9d 100644 (file)
@@ -102,9 +102,12 @@ extern long __copy_to_user(void __user *to, const void *from, unsigned long n);
 static inline long copy_from_user(void *to, const void __user *from,
                                unsigned long n)
 {
-       if (!access_ok(VERIFY_READ, from, n))
-               return n;
-       return __copy_from_user(to, from, n);
+       unsigned long res = n;
+       if (access_ok(VERIFY_READ, from, n))
+               res = __copy_from_user(to, from, n);
+       if (unlikely(res))
+               memset(to + (n - res), 0, res);
+       return res;
 }
 
 static inline long copy_to_user(void __user *to, const void *from,