lkml.org 
[lkml]   [2000]   [Nov]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH] Re: [test11-pre2] rrunner.c compiler error
Blah.  Puke.  Ug.  Not your changes, Bart... which are ok, but
incomplete.

Here is the complete bugfix. There are two places where error
conditions are not fully handled, and 'out_spin' can kfree(image),
saving some code. The worst bug of the list... if the firmware
copy_from_user failed.... we still load firmware [ie. questionable
data] into EEPROM.

--
Jeff Garzik |
Building 1024 | Would you like a Twinkie?
MandrakeSoft |Index: drivers/net/rrunner.c
===================================================================
RCS file: /cvsroot/gkernel/linux_2_4/drivers/net/rrunner.c,v
retrieving revision 1.1.1.4
diff -u -r1.1.1.4 rrunner.c
--- drivers/net/rrunner.c 2000/11/10 02:09:10 1.1.1.4
+++ drivers/net/rrunner.c 2000/11/10 14:21:01
@@ -1550,36 +1550,29 @@

rrpriv = (struct rr_private *)dev->priv;

-
switch(cmd){
case SIOCRRGFW:
- if (!capable(CAP_SYS_RAWIO)){
- error = -EPERM;
- goto out;
- }
+ if (!capable(CAP_SYS_RAWIO))
+ return -EPERM;

image = kmalloc(EEPROM_WORDS * sizeof(u32), GFP_KERNEL);
if (!image){
printk(KERN_ERR "%s: Unable to allocate memory "
"for EEPROM image\n", dev->name);
- error = -ENOMEM;
- goto out;
+ return -ENOMEM;
}

spin_lock(&rrpriv->lock);

if (rrpriv->fw_running){
printk("%s: Firmware already running\n", dev->name);
- kfree(image);
error = -EPERM;
goto out_spin;
}

i = rr_read_eeprom(rrpriv, 0, image, EEPROM_BYTES);
if (i != EEPROM_BYTES){
- kfree(image);
- printk(KERN_ERR "%s: Error reading EEPROM\n",
- dev->name);
+ printk(KERN_ERR "%s: Error reading EEPROM\n", dev->name);
error = -EFAULT;
goto out_spin;
}
@@ -1591,9 +1584,8 @@
return error;

case SIOCRRPFW:
- if (!capable(CAP_SYS_RAWIO)){
+ if (!capable(CAP_SYS_RAWIO))
return -EPERM;
- }

image = kmalloc(EEPROM_WORDS * sizeof(u32), GFP_KERNEL);
if (!image){
@@ -1604,18 +1596,21 @@

oldimage = kmalloc(EEPROM_WORDS * sizeof(u32), GFP_KERNEL);
if (!oldimage){
+ kfree(image);
printk(KERN_ERR "%s: Unable to allocate memory "
"for old EEPROM image\n", dev->name);
return -ENOMEM;
}

error = copy_from_user(image, rq->ifr_data, EEPROM_BYTES);
- if (error)
- error = -EFAULT;
+ if (error) {
+ kfree(image);
+ kfree(oldimage);
+ return -EFAULT;
+ }

spin_lock(&rrpriv->lock);
if (rrpriv->fw_running){
- kfree(image);
kfree(oldimage);
printk("%s: Firmware already running\n", dev->name);
error = -EPERM;
@@ -1652,6 +1647,7 @@
}

out_spin:
+ kfree(image);
spin_unlock(&rrpriv->lock);
return error;
}
\
 
 \ /
  Last update: 2005-03-22 12:45    [W:0.032 / U:5.336 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site