Messages in this thread | | | Date | Tue, 17 Dec 2013 09:39:34 -0800 | From | Greg KH <> | Subject | Re: [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c |
| |
On Mon, Dec 16, 2013 at 10:21:36PM +0800, xqx12 wrote: > there is an overflow in the code : > cyz_polling_cycle = (arg * HZ) / 1000, > the multiplicator arg comes from user, so it may be an overflow if > arg is a big number. And the value of cyc_polling_cycle will be > wrong when it is used next time. > > Reported-by: Qixue Xiao <xiaoqixue_1@163.com> > Suggested-by: Yongjian Xu <xuyongjiande@gmail.com> > Suggested-by: Yu Chen <chyyuu@gmail.com> > Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com> > --- > drivers/tty/cyclades.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c > index cfeec97..7eec1c5 100644 > --- a/drivers/tty/cyclades.c > +++ b/drivers/tty/cyclades.c > @@ -2728,7 +2728,8 @@ cy_ioctl(struct tty_struct *tty, > break; > #ifndef CONFIG_CYZ_INTR > case CYZSETPOLLCYCLE: > + if (arg > LONG_MAX / HZ) > + return -ENODEV;
This patch fails to apply at all to any of my trees, can you please redo it against the latest tty tree and resend it so that I can apply it?
thanks,
greg k-h
| |