lkml.org 
[lkml]   [2006]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 49/61] ISDN: fix drivers, by handling errors thrown by ->readstat()
    On Wed, Nov 01, 2006 at 08:49:22AM +0100, Willy Tarreau wrote:
    > On Tue, Oct 31, 2006 at 09:34:29PM -0800, Chris Wright wrote:
    > > -stable review patch. If anyone has any objections, please let us know.
    > > ------------------
    > >
    > > From: Jeff Garzik <jeff@garzik.org>
    > >
    > > This is a particularly ugly on-failure bug, possibly security, since the
    > > lack of error handling here is covering up another class of bug: failure to
    > > handle copy_to_user() return values.
    > >
    > > The I4L API function ->readstat() returns an integer, and by looking at
    > > several existing driver implementations, it is clear that a negative return
    > > value was meant to indicate an error.
    > >
    > > Given that several drivers already return a negative value indicating an
    > > errno-style error, the current code would blindly accept that [negative]
    > > value as a valid amount of bytes read. Obvious damage ensues.
    > >
    > > Correcting ->readstat() handling to properly notice errors fixes the
    > > existing code to work correctly on error, and enables future patches to
    > > more easily indicate errors during operation.
    > >
    > > Signed-off-by: Jeff Garzik <jeff@garzik.org>
    > > Cc: Karsten Keil <kkeil@suse.de>
    > > Cc: <stable@kernel.org>
    > > Signed-off-by: Andrew Morton <akpm@osdl.org>
    > > Signed-off-by: Linus Torvalds <torvalds@osdl.org>
    > > Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    > > ---
    > > drivers/isdn/i4l/isdn_common.c | 9 ++++++---
    > > 1 file changed, 6 insertions(+), 3 deletions(-)
    > >
    > > --- linux-2.6.18.1.orig/drivers/isdn/i4l/isdn_common.c
    > > +++ linux-2.6.18.1/drivers/isdn/i4l/isdn_common.c
    > > @@ -1134,9 +1134,12 @@ isdn_read(struct file *file, char __user
    > > if (dev->drv[drvidx]->interface->readstat) {
    > > if (count > dev->drv[drvidx]->stavail)
    > > count = dev->drv[drvidx]->stavail;
    > > - len = dev->drv[drvidx]->interface->
    > > - readstat(buf, count, drvidx,
    > > - isdn_minor2chan(minor));
    > > + len = dev->drv[drvidx]->interface->readstat(buf, count,
    > > + drvidx, isdn_minor2chan(minor));
    > > + if (len < 0) {
    > > + retval = len;
    > > + goto out;
    > > + }
    > > } else {
    > > len = 0;
    > > }
    >
    > Seems appropriate for 2.4 too. Jeff, Karsten, no objection ?
    >

    Yes, OK for me.

    --
    Karsten Keil
    SuSE Labs
    ISDN development
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-11-01 10:21    [W:0.024 / U:151.788 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site