[SPARC]: Fix regression in sys_getdomainname()

This patch corrects the buffer length checking in the
sys_getdomainname() implementation for sparc/sparc64.

Signed-off-by: Andy Walker <andy@puszczka.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/arch/sparc/kernel/sys_sparc.c b/arch/sparc/kernel/sys_sparc.c
index 94ff58c9d4a97725198e43bf47b92b83c13e1d0a..896863fb208a1a3e61f83f60b6f45860c4076115 100644 (file)
--- a/arch/sparc/kernel/sys_sparc.c
+++ b/arch/sparc/kernel/sys_sparc.c
@@ -470,19 +470,21 @@ asmlinkage int sys_getdomainname(char __user *name, int len)
 {
        int nlen, err;
        
-       if (len < 0 || len > __NEW_UTS_LEN)
+       if (len < 0)
                return -EINVAL;
 
        down_read(&uts_sem);
        
        nlen = strlen(system_utsname.domainname) + 1;
-       if (nlen < len)
-               len = nlen;
+       err = -EINVAL;
+       if (nlen > len)
+               goto out;
 
        err = -EFAULT;
-       if (!copy_to_user(name, system_utsname.domainname, len))
+       if (!copy_to_user(name, system_utsname.domainname, nlen))
                err = 0;
 
+out:
        up_read(&uts_sem);
        return err;
 }

diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
index bf5f14ee73def064e8d981707ad289e8f60d02a1..c608c947e6c3dfb125ee6bb75358a7c0049f0ba0 100644 (file)
--- a/arch/sparc64/kernel/sys_sparc.c
+++ b/arch/sparc64/kernel/sys_sparc.c
@@ -707,19 +707,21 @@ asmlinkage long sys_getdomainname(char __user *name, int len)
 {
         int nlen, err;
 
-       if (len < 0 || len > __NEW_UTS_LEN)
+       if (len < 0)
                return -EINVAL;
 
        down_read(&uts_sem);
        
        nlen = strlen(system_utsname.domainname) + 1;
-        if (nlen < len)
-                len = nlen;
+       err = -EINVAL;
+       if (nlen > len)
+               goto out;
 
        err = -EFAULT;
-       if (!copy_to_user(name, system_utsname.domainname, len))
+       if (!copy_to_user(name, system_utsname.domainname, nlen))
                err = 0;
 
+out:
        up_read(&uts_sem);
        return err;
 }