All of lore.kernel.org
 help / color / mirror / Atom feed
From: Paul Mundt <lethal@linux-sh.org>
To: Dan Carpenter <error27@gmail.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org,
	kernel-janitors@vger.kernel.org
Subject: Re: [patch 2/2] fbcmap: integer overflow bug
Date: Mon, 15 Nov 2010 04:48:20 +0000	[thread overview]
Message-ID: <20101115044820.GA8489@linux-sh.org> (raw)
In-Reply-To: <20101113100718.GB1795@bicker>

On Sat, Nov 13, 2010 at 01:07:18PM +0300, Dan Carpenter wrote:
> @@ -256,8 +264,12 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
>  	int rc, size = cmap->len * sizeof(u16);
>  	struct fb_cmap umap;
>  
> +	if (cmap->len * 2 > INT_MAX)
> +		return -EINVAL;
> +
>  	memset(&umap, 0, sizeof(struct fb_cmap));
> -	rc = fb_alloc_cmap(&umap, cmap->len, cmap->transp != NULL);
> +	rc = fb_alloc_cmap_gfp(&umap, cmap->len, cmap->transp != NULL,
> +				GFP_KERNEL);
>  	if (rc)
>  		return rc;
>  	if (copy_from_user(umap.red, cmap->red, size) ||

This looks reasonable, but it probably makes more sense to use -E2BIG
for the overflow case (as other cases are doing already), and also just
to check size directly rather than open-coding the * 2.

WARNING: multiple messages have this Message-ID (diff)
From: Paul Mundt <lethal@linux-sh.org>
To: Dan Carpenter <error27@gmail.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org,
	kernel-janitors@vger.kernel.org
Subject: Re: [patch 2/2] fbcmap: integer overflow bug
Date: Mon, 15 Nov 2010 13:48:20 +0900	[thread overview]
Message-ID: <20101115044820.GA8489@linux-sh.org> (raw)
In-Reply-To: <20101113100718.GB1795@bicker>

On Sat, Nov 13, 2010 at 01:07:18PM +0300, Dan Carpenter wrote:
> @@ -256,8 +264,12 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
>  	int rc, size = cmap->len * sizeof(u16);
>  	struct fb_cmap umap;
>  
> +	if (cmap->len * 2 > INT_MAX)
> +		return -EINVAL;
> +
>  	memset(&umap, 0, sizeof(struct fb_cmap));
> -	rc = fb_alloc_cmap(&umap, cmap->len, cmap->transp != NULL);
> +	rc = fb_alloc_cmap_gfp(&umap, cmap->len, cmap->transp != NULL,
> +				GFP_KERNEL);
>  	if (rc)
>  		return rc;
>  	if (copy_from_user(umap.red, cmap->red, size) ||

This looks reasonable, but it probably makes more sense to use -E2BIG
for the overflow case (as other cases are doing already), and also just
to check size directly rather than open-coding the * 2.

  reply	other threads:[~2010-11-15  4:48 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-10-27  9:37 [RFC] [patch] fbcmap: integer overflow bug Dan Carpenter
2010-10-27  9:37 ` Dan Carpenter
2010-11-05 20:40 ` Andrew Morton
2010-11-05 20:40   ` Andrew Morton
2010-11-13 10:06   ` [patch 1/2] fbcmap: cleanup white space in fb_alloc_cmap() Dan Carpenter
2010-11-13 10:06     ` Dan Carpenter
2010-11-18  6:00     ` Paul Mundt
2010-11-18  6:00       ` Paul Mundt
2010-11-13 10:07   ` [patch 2/2] fbcmap: integer overflow bug Dan Carpenter
2010-11-13 10:07     ` Dan Carpenter
2010-11-15  4:48     ` Paul Mundt [this message]
2010-11-15  4:48       ` Paul Mundt
2010-11-15  6:56       ` Geert Uytterhoeven
2010-11-15  6:56         ` Geert Uytterhoeven
2010-11-15  7:20         ` Dan Carpenter
2010-11-15  7:20           ` Dan Carpenter
2010-11-15  7:20           ` Dan Carpenter
2010-11-15  8:01           ` walter harms
2010-11-15  8:01             ` walter harms
2010-11-15  8:14             ` Dan Carpenter
2010-11-15  8:14               ` Dan Carpenter
2010-11-16  9:11       ` [patch 2/2 v2] " Dan Carpenter
2010-11-16  9:11         ` Dan Carpenter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20101115044820.GA8489@linux-sh.org \
    --to=lethal@linux-sh.org \
    --cc=akpm@linux-foundation.org \
    --cc=error27@gmail.com \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=linux-fbdev@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.