Re: 2.6.17-rc4-mm1

Jesper Juhl
2006-05-15T18:04:22Z

On Monday 15 May 2006 09:56, Andrew Morton wrote:
>
> ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.17-rc4/2.6.17-rc4-mm1/
>
Hi Andrew,

While going through my patches currently in -mm I noticed a problem.
I have to hang my head i shame and admit to introducing a bug in what should
have been a bugFIX patch :-(

In the
isdn-unsafe-interaction-between-isdn_write-and-isdn_writebuf_stub.patch
patch, which is currently in -mm there's a bug.

This bit :
- copy_from_user(skb_put(skb, len), buf, len);
+ if (!copy_from_user(skb_put(skb, len), buf, len))
should really be :
- copy_from_user(skb_put(skb, len), buf, len);
+ if (copy_from_user(skb_put(skb, len), buf, len))
Somehow a stray "!" crept in there.

Sorry about that. Here's a tiny fix-it-up patch to be applied on top :

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>

--- linux-2.6.17-rc4-mm1-orig/drivers/isdn/i4l/isdn_common.c 2006-05-15 19:43:06.000000000 +0200
+++ linux-2.6.17-rc4-mm1/drivers/isdn/i4l/isdn_common.c 2006-05-15 19:58:26.000000000 +0200
@@ -1952,7 +1952,7 @@ isdn_writebuf_stub(int drvidx, int chan,
if (!skb)
return -ENOMEM;
skb_reserve(skb, hl);
- if (!copy_from_user(skb_put(skb, len), buf, len))
+ if (copy_from_user(skb_put(skb, len), buf, len))
return -EFAULT;
ret = dev->drv[drvidx]->interface->writebuf_skb(drvidx, chan, 1, skb);
if (ret <= 0)