Skip to contentSkip to conversation

radio-bcm2048.c: fix wrong overflow check

PATCH Superseded Pavel Machek 6 participants 15 messages Apr 20, 2014 – May 11, 2014

Subsystems (2)

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 radio-bcm2048.c: fix wrong overflow check

Fix wrong overflow check in radio-bcm2048.

drivers/staging/media/bcm2048/radio-bcm2048.c +1 -1
index b2cd3a8..bbf236e 100644
@@ -737,7 +737,7 @@ static int bcm2048_set_region(struct bcm2048_device *bdev, u8 region)
 	int err;
 	u32 new_frequency = 0;
 
-	if (region > ARRAY_SIZE(region_configs))
+	if (region >= ARRAY_SIZE(region_configs))
 		return -EINVAL;
 
 	mutex_lock(&bdev->mutex);
Signature · 2 lines
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
#1 lore raw
Quoted 5 lines · Pavel Machek

Fix wrong overflow check in radio-bcm2048.

Signed off means like you're signing a legal document to show that you didn't do anything illegal when you handled the patch. Was this patch authored by Pali? If so, then use the From: header.

Btw, I reported this bug on Dec 10 last year. It's better that we fix it now than not fix it at all but we could have done better. Was the kbuild-zero-day bug report format confusing or how could I have helped out there?

regards,
dan carpenter

#2 lore raw
Quoted 11 lines · On Tuesday 22 April 2014 10:39:17 Dan Carpenter wrote:
Quoted 4 lines · Pavel Machek

Fix wrong overflow check in radio-bcm2048.

Signed off means like you're signing a legal document to show that you didn't do anything illegal when you handled the patch. Was this patch authored by Pali? If so, then use the
From: header.

Quoted 7 lines

Btw, I reported this bug on Dec 10 last year. It's better that we fix it now than not fix it at all but we could have done better. Was the kbuild-zero-day bug report format confusing or how could I have helped out there?

regards,
dan carpenter

Hello, I sent this patch months ago, but not generated by commmand git format-patch. And yes, this problem was reported by some public static code checker.

Signature · 2 lines
Pali Rohár
[email protected]
#3 lore raw
Quoted 17 lines · Pali Rohár
Quoted 16 lines · On Tuesday 22 April 2014 10:39:17 Dan Carpenter wrote:
Quoted 4 lines · Pavel Machek

Fix wrong overflow check in radio-bcm2048.

Signed off means like you're signing a legal document to show that you didn't do anything illegal when you handled the patch. Was this patch authored by Pali? If so, then use the
From: header.

Btw, I reported this bug on Dec 10 last year. It's better that we fix it now than not fix it at all but we could have done better. Was the kbuild-zero-day bug report format confusing or how could I have helped out there?

Quoted 5 lines
Quoted 2 lines

regards,
dan carpenter

Hello, I sent this patch months ago, but not generated by commmand git format-patch.

You should still have recieved authorship credit instead of Pavel. It's a newbie mistake which I have made myself. Pavel, use the From: header to give authorship credit. It goes on the first line of the email.

Did you send it to the correct list? This patch should have gone to [email protected]. I see now that they are not CC'd. Please resend it to the correct list.

Quoted 1 line

And yes, this problem was reported by some public static code checker.

I was the public static code checker and I sent the bug report from my @oracle.com email address. Please, give me a Reported-by credit since you are resending this patch anyway.

regards,
dan carpenter

#4 lore raw
Quoted 24 lines · Dan Carpenter
Quoted 17 lines · Pali Rohár
Quoted 16 lines · On Tuesday 22 April 2014 10:39:17 Dan Carpenter wrote:
Quoted 4 lines · Pavel Machek

Fix wrong overflow check in radio-bcm2048.

Signed off means like you're signing a legal document to show that you didn't do anything illegal when you handled the patch. Was this patch authored by Pali? If so, then use the
From: header.

Btw, I reported this bug on Dec 10 last year. It's better that we fix it now than not fix it at all but we could have done better. Was the kbuild-zero-day bug report format confusing or how could I have helped out there?

Quoted 5 lines
Quoted 2 lines

regards,
dan carpenter

Hello, I sent this patch months ago, but not generated by commmand git format-patch.

Quoted 7 lines

You should still have recieved authorship credit instead of Pavel. It's a newbie mistake which I have made myself. Pavel, use the From: header to give authorship credit. It goes on the first line of the email.

Did you send it to the correct list? This patch should have gone to [email protected]. I see now that they are not CC'd. Please resend it to the correct list.

How many more mails need to be generated for single line trivial patch? It is staging driver, so Greg should take it. Anyway, cc-ed the list now.

Quoted 5 lines
Quoted 1 line

And yes, this problem was reported by some public static code checker.

I was the public static code checker and I sent the bug report from my @oracle.com email address. Please, give me a Reported-by credit since you are resending this patch anyway.

Feel free to resubmit the patch yourself.

Pavel

Signature · 2 lines
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
#5 lore raw
Quoted 4 lines · On Tuesday 22 April 2014 11:38:36 Pavel Machek wrote:
Quoted 3 lines · Dan Carpenter
Quoted 2 lines · Pali Rohár
Quoted 1 line · On Tuesday 22 April 2014 10:39:17 Dan Carpenter wrote:

On Sun, Apr 20, 2014 at 04:56:22PM +0200, Pavel Machek

Quoted 38 lines · wrote:
Quoted 22 lines
Quoted 16 lines
Quoted 16 lines
Quoted 4 lines

Fix wrong overflow check in radio-bcm2048.

Signed off means like you're signing a legal document to show that you didn't do anything illegal when you handled the patch. Was this patch authored by Pali? If so, then use the From: header.

Btw, I reported this bug on Dec 10 last year. It's better that we fix it now than not fix it at all but we could have done better. Was the kbuild-zero-day bug report format confusing or how could I have helped out there?

Quoted 5 lines
Quoted 2 lines

regards,
dan carpenter

Hello, I sent this patch months ago, but not generated by commmand git format-patch.

Quoted 8 lines

You should still have recieved authorship credit instead of Pavel. It's a newbie mistake which I have made myself. Pavel, use the From: header to give authorship credit. It goes on the first line of the email.

Did you send it to the correct list? This patch should have gone to [email protected]. I see now that they are not CC'd. Please resend it to the correct list.

How many more mails need to be generated for single line trivial patch? It is staging driver, so Greg should take it. Anyway, cc-ed the list now.

Quoted 3 lines
Quoted 2 lines

And yes, this problem was reported by some public static code checker.

Quoted 8 lines
Quoted 4 lines

I was the public static code checker and I sent the bug report from my @oracle.com email address. Please, give me a Reported-by credit since you are resending this patch anyway.

Feel free to resubmit the patch yourself.

Pavel

I agree with Pavel, this patch which fixing buffer overflow bug should have been already included in kernel tree. And I think it really does not matter which from, to or cc lines are specified for singleline patch which was inspirated by static code checker. Rather to have fixed bug as talking who found it or who fixed it.

Signature · 2 lines
Pali Rohár
[email protected]
#6 lore raw

PATCH v2 1/1 radio-bcm2048.c: fix wrong overflow check

From: Pali Rohár <[email protected]>

This patch fixes an off by one check in bcm2048_set_region().

---
v2: Send it to the correct list. Re-work the changelog.

This patch has been floating around for four months but Pavel and Pali are knuckle-heads and don't know how to use get_maintainer.pl so they never send it to linux-media.

Also Pali doesn't give reporter credit and Pavel steals authorship credit.

Also when you try explain to them about how to send patches correctly they complain that they have been trying but it is too much work so now I have to do it. During the past four months thousands of other people have been able to send patches in the correct format to the correct list but it is too difficult for Pavel and Pali... *sigh*.

drivers/staging/media/bcm2048/radio-bcm2048.c +1 -1
index b2cd3a8..bbf236e 100644
@@ -737,7 +737,7 @@ static int bcm2048_set_region(struct bcm2048_device *bdev, u8 region)
 	int err;
 	u32 new_frequency = 0;
 
-	if (region > ARRAY_SIZE(region_configs))
+	if (region >= ARRAY_SIZE(region_configs))
 		return -EINVAL;
 
 	mutex_lock(&bdev->mutex);
#7 lore raw

PATCH v3 1/1 radio-bcm2048: fix wrong overflow check

From: Pali Rohár <[email protected]>

This patch fixes an off by one check in bcm2048_set_region().

---
v2: Send it to the correct list. Re-work the changelog.
v3: Correct subsystem prefix.

drivers/staging/media/bcm2048/radio-bcm2048.c +1 -1
index b2cd3a8..bbf236e 100644
@@ -737,7 +737,7 @@ static int bcm2048_set_region(struct bcm2048_device *bdev, u8 region)
 	int err;
 	u32 new_frequency = 0;
 
-	if (region > ARRAY_SIZE(region_configs))
+	if (region >= ARRAY_SIZE(region_configs))
 		return -EINVAL;
 
 	mutex_lock(&bdev->mutex);
#8 lore raw
In reply to Dan Carpenter
Quoted 15 lines · Dan Carpenter

From: Pali Rohár <[email protected]>

This patch fixes an off by one check in bcm2048_set_region().

---
v2: Send it to the correct list. Re-work the changelog.

This patch has been floating around for four months but Pavel and Pali are knuckle-heads and don't know how to use get_maintainer.pl so they never send it to linux-media.

Quoted 8 lines

Also Pali doesn't give reporter credit and Pavel steals authorship credit.

Also when you try explain to them about how to send patches correctly they complain that they have been trying but it is too much work so now I have to do it. During the past four months thousands of other people have been able to send patches in the correct format to the correct list but it is too difficult for Pavel and Pali... *sigh*.

Seems like it's not in linux-next as of today, so I am taking it now. Thanks,

Signature · 2 lines
Jiri Kosina
SUSE Labs
#9 lore raw
Quoted 27 lines · On Monday 05 May 2014 15:34:29 Jiri Kosina wrote:
Quoted 19 lines · Dan Carpenter

From: Pali Rohár <[email protected]>

This patch fixes an off by one check in
bcm2048_set_region().

---
v2: Send it to the correct list. Re-work the changelog.

This patch has been floating around for four months but Pavel and Pali are knuckle-heads and don't know how to use get_maintainer.pl so they never send it to linux-media.

Also Pali doesn't give reporter credit and Pavel steals authorship credit.

Quoted 6 lines

Also when you try explain to them about how to send patches correctly they complain that they have been trying but it is too much work so now I have to do it. During the past four months thousands of other people have been able to send patches in the correct format to the correct list but it is too difficult for Pavel and Pali... *sigh*.

Quoted 2 lines

Seems like it's not in linux-next as of today, so I am taking it now. Thanks,

I still do not see this patch in torvalds branch... So what is needed to include this security buffer overflow patch into mainline & stable kernels?

Signature · 2 lines
Pali Rohár
[email protected]
#10 lore raw
Quoted 28 lines · Pali Rohár
Quoted 27 lines · On Monday 05 May 2014 15:34:29 Jiri Kosina wrote:
Quoted 25 lines · Dan Carpenter

From: Pali Rohár <[email protected]>

This patch fixes an off by one check in
bcm2048_set_region().

---
v2: Send it to the correct list. Re-work the changelog.

This patch has been floating around for four months but Pavel and Pali are knuckle-heads and don't know how to use get_maintainer.pl so they never send it to linux-media.

Also Pali doesn't give reporter credit and Pavel steals authorship credit.

Also when you try explain to them about how to send patches correctly they complain that they have been trying but it is too much work so now I have to do it. During the past four months thousands of other people have been able to send patches in the correct format to the correct list but it is too difficult for Pavel and Pali... *sigh*.

Quoted 7 lines
Quoted 2 lines

Seems like it's not in linux-next as of today, so I am taking it now. Thanks,

I still do not see this patch in torvalds branch... So what is needed to include this security buffer overflow patch into mainline & stable kernels?

Today I collected a pile of pending patches including this one and posted a pull request on the linux-media mailinglist. Once Mauro picks it up it will appear in our tree and then linux-next. He's been travelling for the past two weeks, so he'll have a sizable backlog.

Just be patient, it's not forgotten.

Regards,

Hans

#11 lore raw
In reply to Pali Rohár
Quoted 6 lines · Pali Rohár
Quoted 2 lines

Seems like it's not in linux-next as of today, so I am taking it now. Thanks,

I still do not see this patch in torvalds branch... So what is needed to include this security buffer overflow patch into mainline & stable kernels?

I picked it up 4 days ago into trivial.git, which is a tree that doesn't get pushed to Linus really super-often.

Of course, if, in the meantime, this goes in through maintainer tree, even better.

Signature · 2 lines
Jiri Kosina
SUSE Labs
#13 lore raw
In reply to Pavel Machek
Quoted 29 lines · Pavel Machek
Quoted 28 lines · Dan Carpenter
Quoted 17 lines · Pali Rohár
Quoted 16 lines · On Tuesday 22 April 2014 10:39:17 Dan Carpenter wrote:
Quoted 4 lines · Pavel Machek

Fix wrong overflow check in radio-bcm2048.

Signed off means like you're signing a legal document to show that you didn't do anything illegal when you handled the patch. Was this patch authored by Pali? If so, then use the
From: header.

Btw, I reported this bug on Dec 10 last year. It's better that we fix it now than not fix it at all but we could have done better. Was the kbuild-zero-day bug report format confusing or how could I have helped out there?

Quoted 5 lines
Quoted 2 lines

regards,
dan carpenter

Hello, I sent this patch months ago, but not generated by commmand git format-patch.

You should still have recieved authorship credit instead of Pavel. It's a newbie mistake which I have made myself. Pavel, use the From: header to give authorship credit. It goes on the first line of the email.

Quoted 7 lines
Quoted 3 lines

Did you send it to the correct list? This patch should have gone to [email protected]. I see now that they are not CC'd. Please resend it to the correct list.

How many more mails need to be generated for single line trivial patch? It is staging driver, so Greg should take it. Anyway, cc-ed the list now.

I don't take drivers/staging/media/ patches, please use get_maintainer.pl to see who does.

greg k-h

#14 lore raw
In reply to Dan Carpenter
Quoted 10 lines · Dan Carpenter
Quoted 5 lines · Pavel Machek

Fix wrong overflow check in radio-bcm2048.

Signed off means like you're signing a legal document to show that you didn't do anything illegal when you handled the patch. Was this patch authored by Pali? If so, then use the From: header.

Who cares, it is single line. And yes, I know what signed-off-by means, thank you.
Pavel

Signature · 2 lines
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html