rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Multiple array index errors in sound/oss/opl3.c in the Linux kernel before 2.6.39 allow local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer.
Vulnerability ID: CVE-2011-1477
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2012-06-21
File: sound/oss/opl3.c
Commit message: sound/oss/opl3: validate voice and channel indexes

User-controllable indexes for voice and channel values may cause reading
and writing beyond the bounds of their respective arrays, leading to
potentially exploitable memory corruption.  Validate these indexes.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit author: Dan Rosenberg

Vulnerable version (before fix):
 static int opl3_load_patch(int dev, int format, const char __user *addr,  static void opl3_panning(int dev, int voice, int value) { 	devc->voc[voice].panning = value; }  static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info  static void opl3_setup_voice(int dev, int voice, int chn) { 	struct channel_info *info = 	&synth_devs[dev]->chn_info[chn];  	opl3_set_instr(dev, voice, info->pgm_num); 

Fixed version (after fix):
 static int opl3_load_patch(int dev, int format, const char __user *addr,  static void opl3_panning(int dev, int voice, int value) {  	if (voice < 0 || voice >= devc->nr_voice) 		return;  	devc->voc[voice].panning = value; }  static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info  static void opl3_setup_voice(int dev, int voice, int chn) { 	struct channel_info *info;  	if (voice < 0 || voice >= devc->nr_voice) 		return;  	if (chn < 0 || chn > 15) 		return;  	info = &synth_devs[dev]->chn_info[chn];  	opl3_set_instr(dev, voice, info->pgm_num); 

Patch:
patch: @@ -845,6 +845,10 @@ static int opl3_load_patch(int dev, int format, const char __user *addr,
 
 static void opl3_panning(int dev, int voice, int value)
 {
+
+	if (voice < 0 || voice >= devc->nr_voice)
+		return;
+
 	devc->voc[voice].panning = value;
 }
 
@@ -1062,8 +1066,15 @@ static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info
 
 static void opl3_setup_voice(int dev, int voice, int chn)
 {
-	struct channel_info *info =
-	&synth_devs[dev]->chn_info[chn];
+	struct channel_info *info;
+
+	if (voice < 0 || voice >= devc->nr_voice)
+		return;
+
+	if (chn < 0 || chn > 15)
+		return;
+
+	info = &synth_devs[dev]->chn_info[chn];
 
 	opl3_set_instr(dev, voice, info->pgm_num);
path: sound/oss/opl3.c
Vulnerability: Multiple array index errors in sound/oss/opl3.c in the Linux kernel before 2.6.39 allow local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer.
Vulnerability ID: CVE-2011-1477
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2012-06-21
File: sound/oss/opl3.c
Commit message: sound/oss/opl3: validate voice and channel indexes

User-controllable indexes for voice and channel values may cause reading
and writing beyond the bounds of their respective arrays, leading to
potentially exploitable memory corruption.  Validate these indexes.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit author: Dan Rosenberg

Vulnerable version (before fix):
 static int opl3_load_patch(int dev, int format, const char __user *addr,  static void opl3_panning(int dev, int voice, int value) { 	devc->voc[voice].panning = value; }  static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info  static void opl3_setup_voice(int dev, int voice, int chn) { 	struct channel_info *info = 	&synth_devs[dev]->chn_info[chn];  	opl3_set_instr(dev, voice, info->pgm_num); 

Fixed version (after fix):
 static int opl3_load_patch(int dev, int format, const char __user *addr,  static void opl3_panning(int dev, int voice, int value) {  	if (voice < 0 || voice >= devc->nr_voice) 		return;  	devc->voc[voice].panning = value; }  static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info  static void opl3_setup_voice(int dev, int voice, int chn) { 	struct channel_info *info;  	if (voice < 0 || voice >= devc->nr_voice) 		return;  	if (chn < 0 || chn > 15) 		return;  	info = &synth_devs[dev]->chn_info[chn];  	opl3_set_instr(dev, voice, info->pgm_num); 

Patch:
patch: @@ -845,6 +845,10 @@ static int opl3_load_patch(int dev, int format, const char __user *addr,
 
 static void opl3_panning(int dev, int voice, int value)
 {
+
+	if (voice < 0 || voice >= devc->nr_voice)
+		return;
+
 	devc->voc[voice].panning = value;
 }
 
@@ -1062,8 +1066,15 @@ static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info
 
 static void opl3_setup_voice(int dev, int voice, int chn)
 {
-	struct channel_info *info =
-	&synth_devs[dev]->chn_info[chn];
+	struct channel_info *info;
+
+	if (voice < 0 || voice >= devc->nr_voice)
+		return;
+
+	if (chn < 0 || chn > 15)
+		return;
+
+	info = &synth_devs[dev]->chn_info[chn];
 
 	opl3_set_instr(dev, voice, info->pgm_num);
path: sound/oss/opl3.c
Vulnerability: The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Vulnerability ID: CVE-2011-1575
CWE: CWE-399
Severity score: 4.9
Project: https://github.com/jedisct1/pure-ftpd
Published: 2011-05-23
File: src/ftp_parser.c
Commit message: Flush the command buffer after switching to TLS.
Fixes a flaw similar to CVE-2011-0411.
Commit author: Frank DENIS

Vulnerable version (before fix):
 static void randomdelay(void)  * -Frank.  */  int sfgets(void) {     struct pollfd pfd;     int pollret;     ssize_t readnb;     signed char seen_r = 0;     static size_t scanned;     static size_t readnbd;          if (scanned > (size_t) 0U) {       /* support pipelining */         readnbd -= scanned;         void parser(void)             addreply_noformat(234, "AUTH TLS OK.");             doreply();             if (tls_cnx == NULL) {                 (void) tls_init_new_session();             }             goto wayout;

Fixed version (after fix):
 static void randomdelay(void)  * -Frank.  */  static size_t scanned; static size_t readnbd;  static void flush_cmd(void) {     scanned = readnbd = (size_t) 0U; }  int sfgets(void) {     struct pollfd pfd;     int pollret;     ssize_t readnb;     signed char seen_r = 0;          if (scanned > (size_t) 0U) {       /* support pipelining */         readnbd -= scanned;         void parser(void)             addreply_noformat(234, "AUTH TLS OK.");             doreply();             if (tls_cnx == NULL) {                 flush_cmd();                 (void) tls_init_new_session();             }             goto wayout;

Patch:
patch: @@ -57,14 +57,20 @@ static void randomdelay(void)
  * -Frank.
  */
 
+static size_t scanned;
+static size_t readnbd;
+
+static void flush_cmd(void)
+{
+    scanned = readnbd = (size_t) 0U;
+}
+
 int sfgets(void)
 {
     struct pollfd pfd;
     int pollret;
     ssize_t readnb;
     signed char seen_r = 0;
-    static size_t scanned;
-    static size_t readnbd;
     
     if (scanned > (size_t) 0U) {       /* support pipelining */
         readnbd -= scanned;        
@@ -362,6 +368,7 @@ void parser(void)
             addreply_noformat(234, "AUTH TLS OK.");
             doreply();
             if (tls_cnx == NULL) {
+                flush_cmd();
                 (void) tls_init_new_session();
             }
             goto wayout;
path: src/ftp_parser.c
Vulnerability: Integer overflow in the sys_oabi_semtimedop function in arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 2.6.39 on the ARM platform, when CONFIG_OABI_COMPAT is enabled, allows local users to gain privileges or cause a denial of service (heap memory corruption) by providing a crafted argument and leveraging a race condition.
Vulnerability ID: CVE-2011-1759
CWE: CWE-189
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2012-06-13
File: arch/arm/kernel/sys_oabi-compat.c
Commit message: ARM: 6891/1: prevent heap corruption in OABI semtimedop

When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument.  A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer.  Fix this by restricting nsops to SEMOPM.
Untested.

Cc: stable@kernel.org
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Commit author: Dan Rosenberg

Vulnerable version (before fix):
 asmlinkage long sys_oabi_semtimedop(int semid, 	long err; 	int i;  	if (nsops < 1) 		return -EINVAL; 	sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL); 	if (!sops)

Fixed version (after fix):
 asmlinkage long sys_oabi_semtimedop(int semid, 	long err; 	int i;  	if (nsops < 1 || nsops > SEMOPM) 		return -EINVAL; 	sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL); 	if (!sops)

Patch:
patch: @@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int semid,
 	long err;
 	int i;
 
-	if (nsops < 1)
+	if (nsops < 1 || nsops > SEMOPM)
 		return -EINVAL;
 	sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
 	if (!sops)
path: arch/arm/kernel/sys_oabi-compat.c
Vulnerability: The ape_read_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media player, and other products, allows remote attackers to cause a denial of service (application crash) via an APE (aka Monkey's Audio) file that contains a header but no frames.
Vulnerability ID: CVE-2011-2161
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2011-05-20
File: libavformat/ape.c
Commit message: Do not attempt to decode APE file with no frames

This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt
Commit author: Kostya

Vulnerable version (before fix):
 static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)             avio_seek(pb, ape->wavheaderlength, SEEK_CUR);     }      if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){         av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);         return -1;

Fixed version (after fix):
 static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)             avio_seek(pb, ape->wavheaderlength, SEEK_CUR);     }      if(!ape->totalframes){         av_log(s, AV_LOG_ERROR, "No frames in the file!\n");         return AVERROR(EINVAL);     }     if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){         av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);         return -1;

Patch:
patch: @@ -242,6 +242,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
             avio_seek(pb, ape->wavheaderlength, SEEK_CUR);
     }
 
+    if(!ape->totalframes){
+        av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
+        return AVERROR(EINVAL);
+    }
     if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){
         av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);
         return -1;
path: libavformat/ape.c
Vulnerability: The ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel before 2.6.39.1 does not properly handle memory allocation for non-initial fragments, which might allow local users to conduct buffer overflow attacks, and gain privileges or obtain sensitive information, via a crafted LDM partition table.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1017.
Vulnerability ID: CVE-2011-2182
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2012-06-13
File: fs/partitions/ldm.c
Commit message: Fix for buffer overflow in ldm_frag_add not sufficient

As Ben Hutchings discovered [1], the patch for CVE-2011-1017 (buffer
overflow in ldm_frag_add) is not sufficient.  The original patch in
commit c340b1d64000 ("fs/partitions/ldm.c: fix oops caused by corrupted
partition table") does not consider that, for subsequent fragments,
previously allocated memory is used.

[1] http://lkml.org/lkml/2011/5/6/407

Reported-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Timo Warns <warns@pre-sense.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Timo Warns

Vulnerable version (before fix):
 static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)  	list_add_tail (&f->list, frags); found: 	if (f->map & (1 << rec)) { 		ldm_error ("Duplicate VBLK, part %d.", rec); 		f->map &= 0x7F;			/* Mark the group as broken */

Fixed version (after fix):
 static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)  	list_add_tail (&f->list, frags); found: 	if (rec >= f->num) { 		ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num); 		return false; 	}  	if (f->map & (1 << rec)) { 		ldm_error ("Duplicate VBLK, part %d.", rec); 		f->map &= 0x7F;			/* Mark the group as broken */

Patch:
patch: @@ -1335,6 +1335,11 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
 
 	list_add_tail (&f->list, frags);
 found:
+	if (rec >= f->num) {
+		ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
+		return false;
+	}
+
 	if (f->map & (1 << rec)) {
 		ldm_error ("Duplicate VBLK, part %d.", rec);
 		f->map &= 0x7F;			/* Mark the group as broken */
path: fs/partitions/ldm.c
Vulnerability: kernel/taskstats.c in the Linux kernel before 3.1 allows local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another user's password.
Vulnerability ID: CVE-2011-2494
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2012-06-13
File: kernel/taskstats.c
Commit message: Make TASKSTATS require root access

Ok, this isn't optimal, since it means that 'iotop' needs admin
capabilities, and we may have to work on this some more.  But at the
same time it is very much not acceptable to let anybody just read
anybody elses IO statistics quite at this level.

Use of the GENL_ADMIN_PERM suggested by Johannes Berg as an alternative
to checking the capabilities by hand.

Reported-by: Vasiliy Kulikov <segoon@openwall.com>
Cc: Johannes Berg <johannes.berg@intel.com>
Acked-by: Balbir Singh <bsingharora@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Linus Torvalds

Vulnerable version (before fix):
 static struct genl_ops taskstats_ops = { 	.cmd		= TASKSTATS_CMD_GET, 	.doit		= taskstats_user_cmd, 	.policy		= taskstats_cmd_get_policy, };  static struct genl_ops cgroupstats_ops = {

Fixed version (after fix):
 static struct genl_ops taskstats_ops = { 	.cmd		= TASKSTATS_CMD_GET, 	.doit		= taskstats_user_cmd, 	.policy		= taskstats_cmd_get_policy, 	.flags		= GENL_ADMIN_PERM, };  static struct genl_ops cgroupstats_ops = {

Patch:
patch: @@ -655,6 +655,7 @@ static struct genl_ops taskstats_ops = {
 	.cmd		= TASKSTATS_CMD_GET,
 	.doit		= taskstats_user_cmd,
 	.policy		= taskstats_cmd_get_policy,
+	.flags		= GENL_ADMIN_PERM,
 };
 
 static struct genl_ops cgroupstats_ops = {
path: kernel/taskstats.c
Vulnerability: Integer overflow in the vma_to_resize function in mm/mremap.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (BUG_ON and system crash) via a crafted mremap system call that expands a memory mapping.
Vulnerability ID: CVE-2011-2496
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-06-13
File: mm/mremap.c
Commit message: mm: avoid wrapping vm_pgoff in mremap()

The normal mmap paths all avoid creating a mapping where the pgoff
inside the mapping could wrap around due to overflow.  However, an
expanding mremap() can take such a non-wrapping mapping and make it
bigger and cause a wrapping condition.

Noticed by Robert Swiecki when running a system call fuzzer, where it
caused a BUG_ON() due to terminally confusing the vma_prio_tree code.  A
vma dumping patch by Hugh then pinpointed the crazy wrapped case.

Reported-and-tested-by: Robert Swiecki <robert@swiecki.net>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Linus Torvalds

Vulnerable version (before fix):
 static struct vm_area_struct *vma_to_resize(unsigned long addr, 	if (old_len > vma->vm_end - addr) 		goto Efault;  	if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) { 		if (new_len > old_len) 			goto Efault; 	}  	if (vma->vm_flags & VM_LOCKED) {

Fixed version (after fix):
 static struct vm_area_struct *vma_to_resize(unsigned long addr, 	if (old_len > vma->vm_end - addr) 		goto Efault;  	/* Need to be careful about a growing mapping */ 	if (new_len > old_len) { 		unsigned long pgoff;  		if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) 			goto Efault; 		pgoff = (addr - vma->vm_start) >> PAGE_SHIFT; 		pgoff += vma->vm_pgoff; 		if (pgoff + (new_len >> PAGE_SHIFT) < pgoff) 			goto Einval; 	}  	if (vma->vm_flags & VM_LOCKED) {

Patch:
patch: @@ -277,9 +277,16 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
 	if (old_len > vma->vm_end - addr)
 		goto Efault;
 
-	if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) {
-		if (new_len > old_len)
+	/* Need to be careful about a growing mapping */
+	if (new_len > old_len) {
+		unsigned long pgoff;
+
+		if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP))
 			goto Efault;
+		pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
+		pgoff += vma->vm_pgoff;
+		if (pgoff + (new_len >> PAGE_SHIFT) < pgoff)
+			goto Einval;
 	}
 
 	if (vma->vm_flags & VM_LOCKED) {
path: mm/mremap.c
Vulnerability: The tomoyo_mount_acl function in security/tomoyo/mount.c in the Linux kernel before 2.6.39.2 calls the kern_path function with arguments taken directly from a mount system call, which allows local users to cause a denial of service (OOPS) or possibly have unspecified other impact via a NULL value for the device name.
Vulnerability ID: CVE-2011-2518
CWE: CWE-20
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-05-24
File: security/tomoyo/mount.c
Commit message: TOMOYO: Fix oops in tomoyo_mount_acl().

In tomoyo_mount_acl() since 2.6.36, kern_path() was called without checking
dev_name != NULL. As a result, an unprivileged user can trigger oops by issuing
mount(NULL, "/", "ext3", 0, NULL) request.
Fix this by checking dev_name != NULL before calling kern_path(dev_name).

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: stable@kernel.org
Signed-off-by: James Morris <jmorris@namei.org>
Commit author: Tetsuo Handa

Vulnerable version (before fix):
 static int tomoyo_mount_acl(struct tomoyo_request_info *r, char *dev_name, 	} 	if (need_dev) { 		/* Get mount point or device file. */ 		if (kern_path(dev_name, LOOKUP_FOLLOW, &path)) { 			error = -ENOENT; 			goto out; 		}

Fixed version (after fix):
 static int tomoyo_mount_acl(struct tomoyo_request_info *r, char *dev_name, 	} 	if (need_dev) { 		/* Get mount point or device file. */ 		if (!dev_name || kern_path(dev_name, LOOKUP_FOLLOW, &path)) { 			error = -ENOENT; 			goto out; 		}

Patch:
patch: @@ -138,7 +138,7 @@ static int tomoyo_mount_acl(struct tomoyo_request_info *r, char *dev_name,
 	}
 	if (need_dev) {
 		/* Get mount point or device file. */
-		if (kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
+		if (!dev_name || kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
 			error = -ENOENT;
 			goto out;
 		}
path: security/tomoyo/mount.c
Vulnerability: The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not validate user-space pointers, which allows local users to obtain sensitive information from kernel memory locations via a crafted PTRACE_SETXTREGS request.
Vulnerability ID: CVE-2011-2707
CWE: CWE-200
Severity score: 4.9
Project: https://github.com/torvalds/linux
Published: 2012-05-24
File: arch/xtensa/kernel/ptrace.c
Commit message: xtensa: prevent arbitrary read in ptrace

Prevent an arbitrary kernel read.  Check the user pointer with access_ok()
before copying data in.

[akpm@linux-foundation.org: s/EIO/EFAULT/]
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: Christian Zankel <chris@zankel.net>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Dan Rosenberg

Vulnerable version (before fix):
 int ptrace_setxregs(struct task_struct *child, void __user *uregs) 	elf_xtregs_t *xtregs = uregs; 	int ret = 0;  #if XTENSA_HAVE_COPROCESSORS 	/* Flush all coprocessors before we overwrite them. */ 	coprocessor_flush_all(ti);

Fixed version (after fix):
 int ptrace_setxregs(struct task_struct *child, void __user *uregs) 	elf_xtregs_t *xtregs = uregs; 	int ret = 0;  	if (!access_ok(VERIFY_READ, uregs, sizeof(elf_xtregs_t))) 		return -EFAULT;  #if XTENSA_HAVE_COPROCESSORS 	/* Flush all coprocessors before we overwrite them. */ 	coprocessor_flush_all(ti);

Patch:
patch: @@ -147,6 +147,9 @@ int ptrace_setxregs(struct task_struct *child, void __user *uregs)
 	elf_xtregs_t *xtregs = uregs;
 	int ret = 0;
 
+	if (!access_ok(VERIFY_READ, uregs, sizeof(elf_xtregs_t)))
+		return -EFAULT;
+
 #if XTENSA_HAVE_COPROCESSORS
 	/* Flush all coprocessors before we overwrite them. */
 	coprocessor_flush_all(ti);
path: arch/xtensa/kernel/ptrace.c