All of lore.kernel.org
 help / color / mirror / Atom feed
From: walter harms <wharms@bfs.de>
Cc: Ralf Baechle <ralf@linux-mips.org>,
	"David S. Miller" <davem@davemloft.net>,
	netdev@vger.kernel.org, linux-hams@vger.kernel.org,
	Thomas Osterried <thomas@osterried.de>,
	Kernel Janitors List <kernel-janitors@vger.kernel.org>
Subject: Re: [PATCH 3/4] NET: NETROM: Cleanup argument SIOCADDRT ioctl argument
Date: Fri, 25 Nov 2011 12:12:25 +0000	[thread overview]
Message-ID: <4ECF8629.7000301@bfs.de> (raw)
In-Reply-To: <4ECF7A76.3090305@bfs.de>

hi,
according to LXR there are several places where the check is >AX25_MAX_DIGIS instead of >=.

any takers ?

re,
 wh


Am 25.11.2011 12:22, schrieb walter harms:
> 
> 
> Am 25.11.2011 10:09, schrieb Ralf Baechle:
>> nr_route.ndigis is unsigned int so the nr_route.ndigis < 0 expression is
>> never true and can be dropped.  Doing the nr_ax25_dev_get call later
>> allows the nr_route.ndigis test to bail out without having to dev_put.
>>
>> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
>> Cc: Thomas Osterried <thomas@osterried.de>
>> ---
>>  net/netrom/nr_route.c |    6 ++----
>>  1 files changed, 2 insertions(+), 4 deletions(-)
>>
>> diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
>> index 8d7716c..2cf3301 100644
>> --- a/net/netrom/nr_route.c
>> +++ b/net/netrom/nr_route.c
>> @@ -670,12 +670,10 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
>>  	case SIOCADDRT:
>>  		if (copy_from_user(&nr_route, arg, sizeof(struct nr_route_struct)))
>>  			return -EFAULT;
>> -		if ((dev = nr_ax25_dev_get(nr_route.device)) = NULL)
>> +		if (nr_route.ndigis > AX25_MAX_DIGIS)
>>  			return -EINVAL;
>> -		if (nr_route.ndigis < 0 || nr_route.ndigis > AX25_MAX_DIGIS) {
>> -			dev_put(dev);
>> +		if ((dev = nr_ax25_dev_get(nr_route.device)) = NULL)
>>  			return -EINVAL;
>> -		}
>>  		switch (nr_route.type) {
>>  		case NETROM_NODE:
>>  			if (strnlen(nr_route.mnemonic, 7) = 7) {
> 
> I realy do not know if that matters but some use AX25_MAX_DIGIS as array
> and therefore it should be >=AX25_MAX_DIGIS.
> 
> struct rose_route_struct {
>          rose_address    address;
>         unsigned short  mask;
>         ax25_address    neighbour;
>         char            device[16];
>          unsigned char   ndigis;
>          ax25_address    digipeaters[AX25_MAX_DIGIS];
>   };
> --
> To unsubscribe from this list: send the line "unsubscribe linux-hams" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

WARNING: multiple messages have this Message-ID (diff)
From: walter harms <wharms@bfs.de>
Cc: Ralf Baechle <ralf@linux-mips.org>,
	"David S. Miller" <davem@davemloft.net>,
	netdev@vger.kernel.org, linux-hams@vger.kernel.org,
	Thomas Osterried <thomas@osterried.de>,
	Kernel Janitors List <kernel-janitors@vger.kernel.org>
Subject: Re: [PATCH 3/4] NET: NETROM: Cleanup argument SIOCADDRT ioctl argument checking.
Date: Fri, 25 Nov 2011 13:12:25 +0100	[thread overview]
Message-ID: <4ECF8629.7000301@bfs.de> (raw)
In-Reply-To: <4ECF7A76.3090305@bfs.de>

hi,
according to LXR there are several places where the check is >AX25_MAX_DIGIS instead of >=.

any takers ?

re,
 wh


Am 25.11.2011 12:22, schrieb walter harms:
> 
> 
> Am 25.11.2011 10:09, schrieb Ralf Baechle:
>> nr_route.ndigis is unsigned int so the nr_route.ndigis < 0 expression is
>> never true and can be dropped.  Doing the nr_ax25_dev_get call later
>> allows the nr_route.ndigis test to bail out without having to dev_put.
>>
>> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
>> Cc: Thomas Osterried <thomas@osterried.de>
>> ---
>>  net/netrom/nr_route.c |    6 ++----
>>  1 files changed, 2 insertions(+), 4 deletions(-)
>>
>> diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
>> index 8d7716c..2cf3301 100644
>> --- a/net/netrom/nr_route.c
>> +++ b/net/netrom/nr_route.c
>> @@ -670,12 +670,10 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
>>  	case SIOCADDRT:
>>  		if (copy_from_user(&nr_route, arg, sizeof(struct nr_route_struct)))
>>  			return -EFAULT;
>> -		if ((dev = nr_ax25_dev_get(nr_route.device)) == NULL)
>> +		if (nr_route.ndigis > AX25_MAX_DIGIS)
>>  			return -EINVAL;
>> -		if (nr_route.ndigis < 0 || nr_route.ndigis > AX25_MAX_DIGIS) {
>> -			dev_put(dev);
>> +		if ((dev = nr_ax25_dev_get(nr_route.device)) == NULL)
>>  			return -EINVAL;
>> -		}
>>  		switch (nr_route.type) {
>>  		case NETROM_NODE:
>>  			if (strnlen(nr_route.mnemonic, 7) == 7) {
> 
> I realy do not know if that matters but some use AX25_MAX_DIGIS as array
> and therefore it should be >=AX25_MAX_DIGIS.
> 
> struct rose_route_struct {
>          rose_address    address;
>         unsigned short  mask;
>         ax25_address    neighbour;
>         char            device[16];
>          unsigned char   ndigis;
>          ax25_address    digipeaters[AX25_MAX_DIGIS];
>   };
> --
> To unsubscribe from this list: send the line "unsubscribe linux-hams" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

WARNING: multiple messages have this Message-ID (diff)
From: walter harms <wharms@bfs.de>
To: unlisted-recipients:; (no To-header on input)
Cc: Ralf Baechle <ralf@linux-mips.org>,
	"David S. Miller" <davem@davemloft.net>,
	netdev@vger.kernel.org, linux-hams@vger.kernel.org,
	Thomas Osterried <thomas@osterried.de>,
	Kernel Janitors List <kernel-janitors@vger.kernel.org>
Subject: Re: [PATCH 3/4] NET: NETROM: Cleanup argument SIOCADDRT ioctl argument checking.
Date: Fri, 25 Nov 2011 13:12:25 +0100	[thread overview]
Message-ID: <4ECF8629.7000301@bfs.de> (raw)
In-Reply-To: <4ECF7A76.3090305@bfs.de>

hi,
according to LXR there are several places where the check is >AX25_MAX_DIGIS instead of >=.

any takers ?

re,
 wh


Am 25.11.2011 12:22, schrieb walter harms:
> 
> 
> Am 25.11.2011 10:09, schrieb Ralf Baechle:
>> nr_route.ndigis is unsigned int so the nr_route.ndigis < 0 expression is
>> never true and can be dropped.  Doing the nr_ax25_dev_get call later
>> allows the nr_route.ndigis test to bail out without having to dev_put.
>>
>> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
>> Cc: Thomas Osterried <thomas@osterried.de>
>> ---
>>  net/netrom/nr_route.c |    6 ++----
>>  1 files changed, 2 insertions(+), 4 deletions(-)
>>
>> diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
>> index 8d7716c..2cf3301 100644
>> --- a/net/netrom/nr_route.c
>> +++ b/net/netrom/nr_route.c
>> @@ -670,12 +670,10 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
>>  	case SIOCADDRT:
>>  		if (copy_from_user(&nr_route, arg, sizeof(struct nr_route_struct)))
>>  			return -EFAULT;
>> -		if ((dev = nr_ax25_dev_get(nr_route.device)) == NULL)
>> +		if (nr_route.ndigis > AX25_MAX_DIGIS)
>>  			return -EINVAL;
>> -		if (nr_route.ndigis < 0 || nr_route.ndigis > AX25_MAX_DIGIS) {
>> -			dev_put(dev);
>> +		if ((dev = nr_ax25_dev_get(nr_route.device)) == NULL)
>>  			return -EINVAL;
>> -		}
>>  		switch (nr_route.type) {
>>  		case NETROM_NODE:
>>  			if (strnlen(nr_route.mnemonic, 7) == 7) {
> 
> I realy do not know if that matters but some use AX25_MAX_DIGIS as array
> and therefore it should be >=AX25_MAX_DIGIS.
> 
> struct rose_route_struct {
>          rose_address    address;
>         unsigned short  mask;
>         ax25_address    neighbour;
>         char            device[16];
>          unsigned char   ndigis;
>          ax25_address    digipeaters[AX25_MAX_DIGIS];
>   };
> --
> To unsubscribe from this list: send the line "unsubscribe linux-hams" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

  reply	other threads:[~2011-11-25 12:12 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-11-25  9:55 [PATCH 0/4] AX.25 and NET/ROM fixes and improvments Ralf Baechle
2011-11-24 16:12 ` [PATCH 1/4] NET: AX.25: Check ioctl arguments to avoid overflows further down the road Ralf Baechle
2011-11-29  6:17   ` David Miller
2011-11-25  9:08 ` [PATCH 2/4] NET: NETROM: When adding a route verify length of mnemonic string Ralf Baechle
2011-11-25 11:36   ` Dan Carpenter
2011-11-29  6:18   ` David Miller
2011-11-25  9:09 ` [PATCH 3/4] NET: NETROM: Cleanup argument SIOCADDRT ioctl argument checking Ralf Baechle
2011-11-25 11:22   ` walter harms
2011-11-25 12:12     ` walter harms [this message]
2011-11-25 12:12       ` walter harms
2011-11-25 12:12       ` walter harms
2011-11-25 13:26       ` Thomas Osterried
2011-11-25 13:26         ` Thomas Osterried
2011-11-29  6:18   ` David Miller
2011-11-25  9:54 ` [PATCH 4/4] NET: NETROM: Fix formatting Ralf Baechle
2011-11-29  6:18   ` David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4ECF8629.7000301@bfs.de \
    --to=wharms@bfs.de \
    --cc=davem@davemloft.net \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=linux-hams@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=ralf@linux-mips.org \
    --cc=thomas@osterried.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.