* [patch] ptp: oops in ptp_ioctl()
@ 2016-05-26 6:46 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2016-05-26 6:46 UTC (permalink / raw)
To: Richard Cochran, Muhammad Falak R Wani; +Cc: netdev, kernel-janitors
If we pass ERR_PTR(-EFAULT) to kfree() then it's going to oops.
Fixes: 2ece068e1b1d ('ptp: use memdup_user().')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 0b1ac6b..d637c93 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -211,6 +211,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
sysoff = memdup_user((void __user *)arg, sizeof(*sysoff));
if (IS_ERR(sysoff)) {
err = PTR_ERR(sysoff);
+ sysoff = NULL;
break;
}
if (sysoff->n_samples > PTP_MAX_SAMPLES) {
^ permalink raw reply related [flat|nested] 6+ messages in thread* [patch] ptp: oops in ptp_ioctl()
@ 2016-05-26 6:46 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2016-05-26 6:46 UTC (permalink / raw)
To: Richard Cochran, Muhammad Falak R Wani; +Cc: netdev, kernel-janitors
If we pass ERR_PTR(-EFAULT) to kfree() then it's going to oops.
Fixes: 2ece068e1b1d ('ptp: use memdup_user().')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 0b1ac6b..d637c93 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -211,6 +211,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
sysoff = memdup_user((void __user *)arg, sizeof(*sysoff));
if (IS_ERR(sysoff)) {
err = PTR_ERR(sysoff);
+ sysoff = NULL;
break;
}
if (sysoff->n_samples > PTP_MAX_SAMPLES) {
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [patch] ptp: oops in ptp_ioctl()
2016-05-26 6:46 ` Dan Carpenter
@ 2016-05-26 17:42 ` Richard Cochran
-1 siblings, 0 replies; 6+ messages in thread
From: Richard Cochran @ 2016-05-26 17:42 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Muhammad Falak R Wani, netdev, kernel-janitors
On Thu, May 26, 2016 at 09:46:22AM +0300, Dan Carpenter wrote:
> If we pass ERR_PTR(-EFAULT) to kfree() then it's going to oops.
Thanks for catching this.
Acked-by: Richard Cochran <richardcochran@gmail.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [patch] ptp: oops in ptp_ioctl()
2016-05-26 6:46 ` Dan Carpenter
@ 2016-05-30 5:32 ` David Miller
-1 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2016-05-30 5:32 UTC (permalink / raw)
To: dan.carpenter; +Cc: richardcochran, falakreyaz, netdev, kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 26 May 2016 09:46:22 +0300
> If we pass ERR_PTR(-EFAULT) to kfree() then it's going to oops.
>
> Fixes: 2ece068e1b1d ('ptp: use memdup_user().')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [patch] ptp: oops in ptp_ioctl()
@ 2016-05-30 5:32 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2016-05-30 5:32 UTC (permalink / raw)
To: dan.carpenter; +Cc: richardcochran, falakreyaz, netdev, kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 26 May 2016 09:46:22 +0300
> If we pass ERR_PTR(-EFAULT) to kfree() then it's going to oops.
>
> Fixes: 2ece068e1b1d ('ptp: use memdup_user().')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-05-30 5:32 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-05-26 6:46 [patch] ptp: oops in ptp_ioctl() Dan Carpenter
2016-05-26 6:46 ` Dan Carpenter
2016-05-26 17:42 ` Richard Cochran
2016-05-26 17:42 ` Richard Cochran
2016-05-30 5:32 ` David Miller
2016-05-30 5:32 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.