powerpc/pseries: lparcfg - fix kbuf[] underflow

In lparcfg_write(), a count of 0 results in kbuf[] being indexed at -1.
Check for count == 0 in the existing check for count > sizeof(kbuf) and
return -EINVAL if true.

Fixes: 74422e2b1939 ("powerpc/pseries: Remove VLA from lparcfg_write()")
Acked-by: Nayna Jain <nayna@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Cc: stable@vger.kernel.org # 4.20
Signed-off-by: George Wilson <gcwilson@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>

diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
index 54b7ecf375b5af53bad1155a3f5a625aa91211ee..3280b7968cab50238568e2e2e4e14d8197f60d70 100644 (file)
--- a/arch/powerpc/platforms/pseries/lparcfg.c
+++ b/arch/powerpc/platforms/pseries/lparcfg.c
@@ -699,7 +699,7 @@ static ssize_t lparcfg_write(struct file *file, const char __user * buf,
        if (!firmware_has_feature(FW_FEATURE_SPLPAR))
                return -EINVAL;
 
-       if (count > sizeof(kbuf))
+       if (count == 0 || count > sizeof(kbuf))
                return -EINVAL;
 
        if (copy_from_user(kbuf, buf, count))