* [patch 5/6] Staging: gdm72xx: underflow bug in gdm_wimax_ioctl_get_data()
@ 2016-02-22 19:33 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2016-02-22 19:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Wim de With, devel, linux-kernel, kernel-janitors,
One Thousand Gnomes
"size" here should be unsigned, otherwise we might end up trying to copy
negative bytes in gdm_wimax_ioctl_get_data() resulting in an information
leak.
Reported-by: Alan Cox <gnomes@lxorguk.ukuu.org.uk>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/staging/gdm72xx/wm_ioctl.h b/drivers/staging/gdm72xx/wm_ioctl.h
index 631cb1d..032cb07 100644
--- a/drivers/staging/gdm72xx/wm_ioctl.h
+++ b/drivers/staging/gdm72xx/wm_ioctl.h
@@ -74,12 +74,12 @@ struct fsm_s {
};
struct data_s {
- int size;
+ unsigned int size;
void *buf;
};
struct udata_s {
- int size;
+ unsigned int size;
void __user *buf;
};
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [patch 5/6] Staging: gdm72xx: underflow bug in gdm_wimax_ioctl_get_data()
@ 2016-02-22 19:33 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2016-02-22 19:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Wim de With, devel, linux-kernel, kernel-janitors,
One Thousand Gnomes
"size" here should be unsigned, otherwise we might end up trying to copy
negative bytes in gdm_wimax_ioctl_get_data() resulting in an information
leak.
Reported-by: Alan Cox <gnomes@lxorguk.ukuu.org.uk>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/staging/gdm72xx/wm_ioctl.h b/drivers/staging/gdm72xx/wm_ioctl.h
index 631cb1d..032cb07 100644
--- a/drivers/staging/gdm72xx/wm_ioctl.h
+++ b/drivers/staging/gdm72xx/wm_ioctl.h
@@ -74,12 +74,12 @@ struct fsm_s {
};
struct data_s {
- int size;
+ unsigned int size;
void *buf;
};
struct udata_s {
- int size;
+ unsigned int size;
void __user *buf;
};
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-02-22 19:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-02-22 19:33 [patch 5/6] Staging: gdm72xx: underflow bug in gdm_wimax_ioctl_get_data() Dan Carpenter
2016-02-22 19:33 ` Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.