Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1946600AbWKAGDJ (ORCPT ); Wed, 1 Nov 2006 01:03:09 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1946602AbWKAGDJ (ORCPT ); Wed, 1 Nov 2006 01:03:09 -0500 Received: from srv5.dvmed.net ([207.36.208.214]:23518 "EHLO mail.dvmed.net") by vger.kernel.org with ESMTP id S1946600AbWKAGDF (ORCPT ); Wed, 1 Nov 2006 01:03:05 -0500 Message-ID: <45483887.3030702@garzik.org> Date: Wed, 01 Nov 2006 01:02:47 -0500 From: Jeff Garzik User-Agent: Thunderbird 1.5.0.7 (X11/20061008) MIME-Version: 1.0 To: Chris Wright CC: linux-kernel@vger.kernel.org, stable@kernel.org, Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , torvalds@osdl.org, akpm@osdl.org, alan@lxorguk.ukuu.org.uk, Karsten Keil Subject: Re: [PATCH 49/61] ISDN: fix drivers, by handling errors thrown by ->readstat() References: <20061101053340.305569000@sous-sol.org> <20061101054422.145185000@sous-sol.org> In-Reply-To: <20061101054422.145185000@sous-sol.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -4.3 (----) X-Spam-Report: SpamAssassin version 3.1.7 on srv5.dvmed.net summary: Content analysis details: (-4.3 points, 5.0 required) Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1845 Lines: 47 Chris Wright wrote: > -stable review patch. If anyone has any objections, please let us know. > ------------------ > > From: Jeff Garzik > > This is a particularly ugly on-failure bug, possibly security, since the > lack of error handling here is covering up another class of bug: failure to > handle copy_to_user() return values. > > The I4L API function ->readstat() returns an integer, and by looking at > several existing driver implementations, it is clear that a negative return > value was meant to indicate an error. > > Given that several drivers already return a negative value indicating an > errno-style error, the current code would blindly accept that [negative] > value as a valid amount of bytes read. Obvious damage ensues. > > Correcting ->readstat() handling to properly notice errors fixes the > existing code to work correctly on error, and enables future patches to > more easily indicate errors during operation. > > Signed-off-by: Jeff Garzik > Cc: Karsten Keil > Cc: > Signed-off-by: Andrew Morton > Signed-off-by: Linus Torvalds > Signed-off-by: Chris Wright No objection, but I would think that you would also want the companion patch: commit 7786ce192fc4917fb9b789dd823476ff8fd6cf66 Author: Jeff Garzik Date: Tue Oct 17 00:10:40 2006 -0700 [PATCH] ISDN: check for userspace copy faults Most of the ISDN ->readstat() implementations needed to check copy_to_user() and put_user() return values. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/