lkml.org 
[lkml]   [2003]   [Jun]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: Misc 2.5 Fixes: cp-user-cmpci
    From
    On Tuesday, Jun 10, 2003, at 05:09 US/Central, Dipankar Sarma wrote:
    >
    > Fix copy/user problems. Not sure why cm_write() needs to do
    > acces_ok() on buffer twice. Also __get_user() return value isn't
    > checked
    > in trans_ac3().

    Hey Dipankar, this file has been fixed in bitkeeper.

    > sound/oss/cmpci.c | 19 +++++++++++++------
    > 1 files changed, 13 insertions(+), 6 deletions(-)
    >
    > diff -puN sound/oss/cmpci.c~cp-user-cmpci sound/oss/cmpci.c
    > --- linux-2.5.70-ds/sound/oss/cmpci.c~cp-user-cmpci 2003-06-08
    > 15:36:16.000000000 +0530
    > +++ linux-2.5.70-ds-dipankar/sound/oss/cmpci.c 2003-06-08
    > 20:39:03.000000000 +0530
    > @@ -588,7 +588,8 @@ static void trans_ac3(struct cm_state *s
    > unsigned short *src = (unsigned short *)source;
    >
    > do {
    > - data = (unsigned long) *src++;
    > + __get_user(data, src);
    > + src++;
    > data <<= 12; // ok for 16-bit data
    > if (s->spdif_counter == 2 || s->spdif_counter == 3)
    > data |= 0x40000000; // indicate AC-3 raw data

    Above you mentioned that __get_user isn't checked, but it clearly
    should be. trans_ac3 has been made to return an error code.

    > @@ -1600,9 +1601,9 @@ static ssize_t cm_write(struct file *fil
    > return -ENXIO;
    > if (!s->dma_adc.ready && (ret = prog_dmabuf(s, 1)))
    > return ret;
    > - if (!access_ok(VERIFY_READ, buffer, count))
    > - return -EFAULT;
    > }
    > + if (!access_ok(VERIFY_READ, buffer, count))
    > + return -EFAULT;
    > ret = 0;
    >
    > while (count > 0) {

    Good catch. However if I'm reading it right you still have two
    access_ok calls (the other is a few lines above this patch context).

    --
    Hollis Blanchard
    IBM Linux Technology Center

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:36    [W:0.032 / U:91.732 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site