Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759827AbbLCNDs (ORCPT ); Thu, 3 Dec 2015 08:03:48 -0500 Received: from mail-wm0-f50.google.com ([74.125.82.50]:38782 "EHLO mail-wm0-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751039AbbLCNDq (ORCPT ); Thu, 3 Dec 2015 08:03:46 -0500 Date: Thu, 3 Dec 2015 13:03:41 +0000 From: Lee Jones To: Arnd Bergmann Cc: linux-arm-kernel@lists.infradead.org, Bjorn Andersson , Ohad Ben-Cohen , "devicetree@vger.kernel.org" , Florian Fainelli , kernel@stlinux.com, Nathan_Lynch@mentor.com, "linux-kernel@vger.kernel.org" , ludovic.barre@st.com, Maxime Coquelin Subject: Re: [RESEND v4 2/6] remoteproc: debugfs: Add ability to boot remote processor using debugfs Message-ID: <20151203130341.GA26902@x1> References: <1448370862-19120-1-git-send-email-lee.jones@linaro.org> <20151203122634.GX12874@x1> <5329827.I5W30K072M@wuerfel> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <5329827.I5W30K072M@wuerfel> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1794 Lines: 50 On Thu, 03 Dec 2015, Arnd Bergmann wrote: > On Thursday 03 December 2015 12:26:34 Lee Jones wrote: > > > > > > > > +static ssize_t rproc_state_write(struct file *filp, const char __user *userbuf, > > > > + size_t count, loff_t *ppos) > > > > +{ > > > > + struct rproc *rproc = filp->private_data; > > > > + char buf[10]; > > > > + int ret; > > > > + > > > > + if (count > sizeof(buf)) > > > > + return count; > > > > + ret = copy_from_user(buf, userbuf, count); > > > > + if (ret) > > > > + return -EFAULT; > > > > + > > > > + if (buf[count - 1] == '\n') > > > > + buf[count - 1] = '\0'; > > > > > > I believe you can get here with count = 0. > > > > I'm pretty sure you can't. > > > > If you are sure that you can, if you can provide me with a way of > > testing, I'd be happy to put in provisions. > > > > I think that a zero-length write() from user space ends up in the write > file operation. I tested this and didn't see it enter write(). My conclusion was that if the file doesn't change, then nothing is triggered. > Also, we get a gcc warning about the out-of-bounds access for code like > this, and checking that count is larger than zero avoids the warning. I did however see this warning and wondered what it was talking about. Thanks for clarifying. Will fix. -- Lee Jones Linaro STMicroelectronics Landing Team Lead Linaro.org │ Open source software for ARM SoCs Follow Linaro: Facebook | Twitter | Blog -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/