[PATCH v2] radio-bcm2048.c: fix wrong overflow check

[PATCH v2] radio-bcm2048.c: fix wrong overflow check

[Pavel Machek]

From: Pali Rohár <pali.rohar@gmail.com>

This patch fixes an off by one check in bcm2048_set_region().

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: Send it to the correct list.  Re-work the changelog.

This patch has been floating around for four months but Pavel and Pali
are knuckle-heads and don't know how to use get_maintainer.pl so they
never send it to linux-media.

Also Pali doesn't give reporter credit and Pavel steals authorship
credit.

Also when you try explain to them about how to send patches correctly
they complain that they have been trying but it is too much work so now
I have to do it.  During the past four months thousands of other people
have been able to send patches in the correct format to the correct list
but it is too difficult for Pavel and Pali...  *sigh*.

diff --git a/drivers/staging/media/bcm2048/radio-bcm2048.c b/drivers/staging/media/bcm2048/radio-bcm2048.c
index b2cd3a8..bbf236e 100644
--- a/drivers/staging/media/bcm2048/radio-bcm2048.c
+++ b/drivers/staging/media/bcm2048/radio-bcm2048.c
@@ -737,7 +737,7 @@ static int bcm2048_set_region(struct bcm2048_device *bdev, u8 region)
 	int err;
 	u32 new_frequency = 0;
 
-	if (region > ARRAY_SIZE(region_configs))
+	if (region >= ARRAY_SIZE(region_configs))
 		return -EINVAL;
 
 	mutex_lock(&bdev->mutex);

-- 

Re: [PATCH] radio-bcm2048.c: fix wrong overflow check

[Pavel Machek]

On Tue 2014-04-22 12:16:56, Dan Carpenter wrote:
> On Tue, Apr 22, 2014 at 10:55:53AM +0200, Pali Rohár wrote:
> > On Tuesday 22 April 2014 10:39:17 Dan Carpenter wrote:
> > > On Sun, Apr 20, 2014 at 04:56:22PM +0200, Pavel Machek wrote:
> > > > Fix wrong overflow check in radio-bcm2048.
> > > > 
> > > > Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
> > > > Signed-off-by: Pavel Machek <pavel@ucw.cz>
> > > 
> > > Signed off means like you're signing a legal document to show
> > > that you didn't do anything illegal when you handled the
> > > patch.  Was this patch authored by Pali?  If so, then use the
> > > From: header.
> > > 
> > > Btw, I reported this bug on Dec 10 last year.  It's better
> > > that we fix it now than not fix it at all but we could have
> > > done better.  Was the kbuild-zero-day bug report format
> > > confusing or how could I have helped out there?
> > > 
> > > regards,
> > > dan carpenter
> > 
> > Hello, I sent this patch months ago, but not generated by
> > commmand git format-patch.
> 
> You should still have recieved authorship credit instead of Pavel.  It's
> a newbie mistake which I have made myself.  Pavel, use the From: header
> to give authorship credit.  It goes on the first line of the email.
> 
> Did you send it to the correct list?  This patch should have gone to
> linux-media@vger.kernel.org.  I see now that they are not CC'd.  Please
> resend it to the correct list.

How many more mails need to be generated for single line trivial
patch? It is staging driver, so Greg should take it. Anyway, cc-ed the
list now.

> > And yes, this problem was reported by some public static code checker.
> 
> I was the public static code checker and I sent the bug report from my
> @oracle.com email address.  Please, give me a Reported-by credit since
> you are resending this patch anyway.

Feel free to resubmit the patch yourself.

									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Re: [PATCH] radio-bcm2048.c: fix wrong overflow check

[Pali Rohár]

[-- Attachment #1: Type: Text/Plain, Size: 2500 bytes --]

On Tuesday 22 April 2014 11:38:36 Pavel Machek wrote:
> On Tue 2014-04-22 12:16:56, Dan Carpenter wrote:
> > On Tue, Apr 22, 2014 at 10:55:53AM +0200, Pali Rohár wrote:
> > > On Tuesday 22 April 2014 10:39:17 Dan Carpenter wrote:
> > > > On Sun, Apr 20, 2014 at 04:56:22PM +0200, Pavel Machek 
wrote:
> > > > > Fix wrong overflow check in radio-bcm2048.
> > > > > 
> > > > > Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
> > > > > Signed-off-by: Pavel Machek <pavel@ucw.cz>
> > > > 
> > > > Signed off means like you're signing a legal document to
> > > > show that you didn't do anything illegal when you
> > > > handled the patch.  Was this patch authored by Pali? 
> > > > If so, then use the From: header.
> > > > 
> > > > Btw, I reported this bug on Dec 10 last year.  It's
> > > > better that we fix it now than not fix it at all but we
> > > > could have done better.  Was the kbuild-zero-day bug
> > > > report format confusing or how could I have helped out
> > > > there?
> > > > 
> > > > regards,
> > > > dan carpenter
> > > 
> > > Hello, I sent this patch months ago, but not generated by
> > > commmand git format-patch.
> > 
> > You should still have recieved authorship credit instead of
> > Pavel.  It's a newbie mistake which I have made myself. 
> > Pavel, use the From: header to give authorship credit.  It
> > goes on the first line of the email.
> > 
> > Did you send it to the correct list?  This patch should have
> > gone to linux-media@vger.kernel.org.  I see now that they
> > are not CC'd.  Please resend it to the correct list.
> 
> How many more mails need to be generated for single line
> trivial patch? It is staging driver, so Greg should take it.
> Anyway, cc-ed the list now.
> 
> > > And yes, this problem was reported by some public static
> > > code checker.
> > 
> > I was the public static code checker and I sent the bug
> > report from my @oracle.com email address.  Please, give me
> > a Reported-by credit since you are resending this patch
> > anyway.
> 
> Feel free to resubmit the patch yourself.
> 
> 									Pavel

I agree with Pavel, this patch which fixing buffer overflow bug 
should have been already included in kernel tree. And I think it 
really does not matter which from, to or cc lines are specified 
for singleline patch which was inspirated by static code checker. 
Rather to have fixed bug as talking who found it or who fixed it.

-- 
Pali Rohár
pali.rohar@gmail.com

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

[PATCH v2] radio-bcm2048.c: fix wrong overflow check

[Dan Carpenter]

From: Pali Rohár <pali.rohar@gmail.com>

This patch fixes an off by one check in bcm2048_set_region().

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: Send it to the correct list.  Re-work the changelog.

This patch has been floating around for four months but Pavel and Pali
are knuckle-heads and don't know how to use get_maintainer.pl so they
never send it to linux-media.

Also Pali doesn't give reporter credit and Pavel steals authorship
credit.

Also when you try explain to them about how to send patches correctly
they complain that they have been trying but it is too much work so now
I have to do it.  During the past four months thousands of other people
have been able to send patches in the correct format to the correct list
but it is too difficult for Pavel and Pali...  *sigh*.

diff --git a/drivers/staging/media/bcm2048/radio-bcm2048.c b/drivers/staging/media/bcm2048/radio-bcm2048.c
index b2cd3a8..bbf236e 100644
--- a/drivers/staging/media/bcm2048/radio-bcm2048.c
+++ b/drivers/staging/media/bcm2048/radio-bcm2048.c
@@ -737,7 +737,7 @@ static int bcm2048_set_region(struct bcm2048_device *bdev, u8 region)
 	int err;
 	u32 new_frequency = 0;
 
-	if (region > ARRAY_SIZE(region_configs))
+	if (region >= ARRAY_SIZE(region_configs))
 		return -EINVAL;
 
 	mutex_lock(&bdev->mutex);

-- 

[PATCH v3] [media] radio-bcm2048: fix wrong overflow check

[Dan Carpenter]

From: Pali Rohár <pali.rohar@gmail.com>

This patch fixes an off by one check in bcm2048_set_region().

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: Send it to the correct list.  Re-work the changelog.
v3: Correct subsystem prefix.

diff --git a/drivers/staging/media/bcm2048/radio-bcm2048.c b/drivers/staging/media/bcm2048/radio-bcm2048.c
index b2cd3a8..bbf236e 100644
--- a/drivers/staging/media/bcm2048/radio-bcm2048.c
+++ b/drivers/staging/media/bcm2048/radio-bcm2048.c
@@ -737,7 +737,7 @@ static int bcm2048_set_region(struct bcm2048_device *bdev, u8 region)
 	int err;
 	u32 new_frequency = 0;
 
-	if (region > ARRAY_SIZE(region_configs))
+	if (region >= ARRAY_SIZE(region_configs))
 		return -EINVAL;
 
 	mutex_lock(&bdev->mutex);

-- 

Re: [PATCH v2] radio-bcm2048.c: fix wrong overflow check

[Jiri Kosina]

On Tue, 22 Apr 2014, Dan Carpenter wrote:

> From: Pali Rohár <pali.rohar@gmail.com>
> 
> This patch fixes an off by one check in bcm2048_set_region().
> 
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
> Signed-off-by: Pavel Machek <pavel@ucw.cz>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: Send it to the correct list.  Re-work the changelog.
> 
> This patch has been floating around for four months but Pavel and Pali
> are knuckle-heads and don't know how to use get_maintainer.pl so they
> never send it to linux-media.
> 
> Also Pali doesn't give reporter credit and Pavel steals authorship
> credit.
> 
> Also when you try explain to them about how to send patches correctly
> they complain that they have been trying but it is too much work so now
> I have to do it.  During the past four months thousands of other people
> have been able to send patches in the correct format to the correct list
> but it is too difficult for Pavel and Pali...  *sigh*.

Seems like it's not in linux-next as of today, so I am taking it now. 
Thanks,

-- 
Jiri Kosina
SUSE Labs

Re: [PATCH v2] radio-bcm2048.c: fix wrong overflow check

[Pali Rohár]

[-- Attachment #1: Type: Text/Plain, Size: 1467 bytes --]

On Monday 05 May 2014 15:34:29 Jiri Kosina wrote:
> On Tue, 22 Apr 2014, Dan Carpenter wrote:
> > From: Pali Rohár <pali.rohar@gmail.com>
> > 
> > This patch fixes an off by one check in
> > bcm2048_set_region().
> > 
> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> > Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
> > Signed-off-by: Pavel Machek <pavel@ucw.cz>
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> > v2: Send it to the correct list.  Re-work the changelog.
> > 
> > This patch has been floating around for four months but
> > Pavel and Pali are knuckle-heads and don't know how to use
> > get_maintainer.pl so they never send it to linux-media.
> > 
> > Also Pali doesn't give reporter credit and Pavel steals
> > authorship credit.
> > 
> > Also when you try explain to them about how to send patches
> > correctly they complain that they have been trying but it
> > is too much work so now I have to do it.  During the past
> > four months thousands of other people have been able to
> > send patches in the correct format to the correct list but
> > it is too difficult for Pavel and Pali...  *sigh*.
> 
> Seems like it's not in linux-next as of today, so I am taking
> it now. Thanks,

I still do not see this patch in torvalds branch... So what is 
needed to include this security buffer overflow patch into 
mainline & stable kernels?

-- 
Pali Rohár
pali.rohar@gmail.com

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [PATCH v2] radio-bcm2048.c: fix wrong overflow check

[Hans Verkuil]

On 05/09/2014 06:10 PM, Pali Rohár wrote:
> On Monday 05 May 2014 15:34:29 Jiri Kosina wrote:
>> On Tue, 22 Apr 2014, Dan Carpenter wrote:
>>> From: Pali Rohár <pali.rohar@gmail.com>
>>>
>>> This patch fixes an off by one check in
>>> bcm2048_set_region().
>>>
>>> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>>> Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
>>> Signed-off-by: Pavel Machek <pavel@ucw.cz>
>>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>> ---
>>> v2: Send it to the correct list.  Re-work the changelog.
>>>
>>> This patch has been floating around for four months but
>>> Pavel and Pali are knuckle-heads and don't know how to use
>>> get_maintainer.pl so they never send it to linux-media.
>>>
>>> Also Pali doesn't give reporter credit and Pavel steals
>>> authorship credit.
>>>
>>> Also when you try explain to them about how to send patches
>>> correctly they complain that they have been trying but it
>>> is too much work so now I have to do it.  During the past
>>> four months thousands of other people have been able to
>>> send patches in the correct format to the correct list but
>>> it is too difficult for Pavel and Pali...  *sigh*.
>>
>> Seems like it's not in linux-next as of today, so I am taking
>> it now. Thanks,
> 
> I still do not see this patch in torvalds branch... So what is 
> needed to include this security buffer overflow patch into 
> mainline & stable kernels?
> 

Today I collected a pile of pending patches including this one and
posted a pull request on the linux-media mailinglist. Once Mauro picks
it up it will appear in our tree and then linux-next. He's been
travelling for the past two weeks, so he'll have a sizable backlog.

Just be patient, it's not forgotten.

Regards,

	Hans

Re: [PATCH v2] radio-bcm2048.c: fix wrong overflow check

[Jiri Kosina]

On Fri, 9 May 2014, Pali Rohár wrote:

> > Seems like it's not in linux-next as of today, so I am taking
> > it now. Thanks,
> 
> I still do not see this patch in torvalds branch... So what is 
> needed to include this security buffer overflow patch into 
> mainline & stable kernels?

I picked it up 4 days ago into trivial.git, which is a tree that doesn't 
get pushed to Linus really super-often.

Of course, if, in the meantime, this goes in through maintainer tree, even 
better.

-- 
Jiri Kosina
SUSE Labs

Re: [PATCH] radio-bcm2048.c: fix wrong overflow check

[Dan Carpenter]

On Tue, Apr 22, 2014 at 11:38:36AM +0200, Pavel Machek wrote:
> Feel free to resubmit the patch yourself.

No problem.  Happy to help.

regards,
dan carpenter

Re: [PATCH] radio-bcm2048.c: fix wrong overflow check

[Greg KH]

On Tue, Apr 22, 2014 at 11:38:36AM +0200, Pavel Machek wrote:
> On Tue 2014-04-22 12:16:56, Dan Carpenter wrote:
> > On Tue, Apr 22, 2014 at 10:55:53AM +0200, Pali Rohár wrote:
> > > On Tuesday 22 April 2014 10:39:17 Dan Carpenter wrote:
> > > > On Sun, Apr 20, 2014 at 04:56:22PM +0200, Pavel Machek wrote:
> > > > > Fix wrong overflow check in radio-bcm2048.
> > > > > 
> > > > > Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
> > > > > Signed-off-by: Pavel Machek <pavel@ucw.cz>
> > > > 
> > > > Signed off means like you're signing a legal document to show
> > > > that you didn't do anything illegal when you handled the
> > > > patch.  Was this patch authored by Pali?  If so, then use the
> > > > From: header.
> > > > 
> > > > Btw, I reported this bug on Dec 10 last year.  It's better
> > > > that we fix it now than not fix it at all but we could have
> > > > done better.  Was the kbuild-zero-day bug report format
> > > > confusing or how could I have helped out there?
> > > > 
> > > > regards,
> > > > dan carpenter
> > > 
> > > Hello, I sent this patch months ago, but not generated by
> > > commmand git format-patch.
> > 
> > You should still have recieved authorship credit instead of Pavel.  It's
> > a newbie mistake which I have made myself.  Pavel, use the From: header
> > to give authorship credit.  It goes on the first line of the email.
> > 
> > Did you send it to the correct list?  This patch should have gone to
> > linux-media@vger.kernel.org.  I see now that they are not CC'd.  Please
> > resend it to the correct list.
> 
> How many more mails need to be generated for single line trivial
> patch? It is staging driver, so Greg should take it. Anyway, cc-ed the
> list now.

I don't take drivers/staging/media/ patches, please use
get_maintainer.pl to see who does.

greg k-h