Messages in this thread | | | Date | Wed, 11 Jul 2018 11:27:40 +0200 | From | Greg Kroah-Hartman <> | Subject | Re: [PATCH] staging: speakup: fix wraparound in uaccess length check |
| |
On Tue, Jul 10, 2018 at 01:34:59PM -0700, Jann Horn wrote: > On Sat, Jul 7, 2018 at 7:03 AM Greg Kroah-Hartman > <gregkh@linuxfoundation.org> wrote: > > > > On Sat, Jul 07, 2018 at 10:29:26AM +0200, Samuel Thibault wrote: > > > Re, > > > > > > Could you review, test, and resubmit the patch below instead? > > > > > > Samuel > > > > > > > > > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > > > the loop to copy as much data as available to the provided buffer. If > > > softsynthx_read() is invoked through sys_splice(), this causes an > > > unbounded kernel write; but even when userspace just reads from it > > > normally, a small size could cause userspace crashes. > > > > > > Fixes: 425e586cf95b ("speakup: add unicode variant of /dev/softsynth") > > > Cc: stable@vger.kernel.org > > > Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> > > > > You forgot a "reported-by:" line :( > > > > also, I already applied Jann's patch, so could you either just send the > > fixup, or a revert/add of this patch once you all agree on the proper > > solution here? > > I think my patch was garbage (as both Samuel and Dan Carpenter's > smatch warning pointed out) and should be reverted. Should I be > sending the revert?
I'll just go drop it, thanks for letting me know.
greg k-h
| |