* [patch] USB: cxacru: fix an bounds check warning
@ 2016-01-30 14:34 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2016-01-30 14:34 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Aaron Raimist, accessrunner-general, linux-usb, linux-kernel,
kernel-janitors
This is a privileged operation so it doesn't matter much. We use "tmp"
as an offset into an array. If it were invalid we could read out of
bounds and trigger an oops if the memory is not mapped. Plus it makes
static checkers complain.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This changes the behavior a little bit because in the original we could
give slightly invalid "len" values and the function would still work...
Please review it extra carefully to make sure it doesn't break
userspace.
diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 1173f9c..0a866e9 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -476,6 +476,8 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
return -EINVAL;
if (index < 0 || index > 0x7f)
return -EINVAL;
+ if (tmp < 0 || tmp > len - pos)
+ return -EINVAL;
pos += tmp;
/* skip trailing newline */
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [patch] USB: cxacru: fix an bounds check warning
@ 2016-01-30 14:34 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2016-01-30 14:34 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Aaron Raimist, accessrunner-general, linux-usb, linux-kernel,
kernel-janitors
This is a privileged operation so it doesn't matter much. We use "tmp"
as an offset into an array. If it were invalid we could read out of
bounds and trigger an oops if the memory is not mapped. Plus it makes
static checkers complain.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This changes the behavior a little bit because in the original we could
give slightly invalid "len" values and the function would still work...
Please review it extra carefully to make sure it doesn't break
userspace.
diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 1173f9c..0a866e9 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -476,6 +476,8 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
return -EINVAL;
if (index < 0 || index > 0x7f)
return -EINVAL;
+ if (tmp < 0 || tmp > len - pos)
+ return -EINVAL;
pos += tmp;
/* skip trailing newline */
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-01-30 14:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-01-30 14:34 [patch] USB: cxacru: fix an bounds check warning Dan Carpenter
2016-01-30 14:34 ` Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.