serial167: Read buffer overflow
Subsystems (2)
PATCH 1/1 serial167: Read buffer overflow
Check whether index is within bounds before grabbing the element. Also, since NR_PORTS is defined ARRAY_SIZE(cy_port), cy_port[NR_PORTS] is out of bounds as well.
---
drivers/char/serial167.c +2 -4
@@ -222,7 +222,7 @@ static inline int serial_paranoia_check(struct cyclades_port *info, char *name, }if ((long )info < (long )(&cy_port[0 ]) - || (long )(&cy_port[NR_PORTS ]) < (long )info) { + || (long )(&cy_port[NR_PORTS -1 ]) < (long )info) {printk ("Warning: cyclades_port out of range for (%s) in %s\n" , name, routine);return 1 ;
@@ -521,15 +521,13 @@ static irqreturn_t cd2401_tx_interrupt(int irq, void *dev_id) panic("TxInt on debug port!!!"); }#endif - - info = &cy_port[channel]; -/* validate the port number (as configured and open) */ if ((channel <0 ) || (NR_PORTS <= channel)) { base_addr[CyIER] &= ~(CyTxMpty | CyTxRdy); base_addr[CyTEOIR] = CyNOTRANS;return IRQ_HANDLED ; } + info = &cy_port[channel]; info->last_active = jiffies;if (info->tty ==0 ) { base_addr[CyIER] &= ~(CyTxMpty | CyTxRdy);
drivers/char/serial167.c static inline int serial_paranoia_check(struct cyclades_port *info, char *name, · line 227
Quoted 8 lines · On Mon, 03 Aug 2009 14:15:22 +0200 Roel Kluin <[email protected]> wrote:
drivers/char/serial167.c +1
-1@@ -222,7 +222,7 @@ static inline int serial_paranoia_check(struct cyclades_port *info, char *name, }if ((long )info < (long )(&cy_port[0 ]) - || (long )(&cy_port[NR_PORTS ]) < (long )info) { + || (long )(&cy_port[NR_PORTS -1 ]) < (long )info) {printk ("Warning: cyclades_port out of range for (%s) in %s\n" , name, routine);
OK, that hurts my brain. And all those casts are pointless. How about this?
if (info < &cy_port[0] || info >= &cy_port[NR_PORTS]) {
printk("Warning: cyclades_port out of range for (%s) in %s\n",
name, routine);
return 1;
}btw, m68k allmodconfig in current mainline is sick:
In file included from /usr/src/devel/arch/m68k/include/asm/pgtable.h:4,
from include/linux/mm.h:40,
from drivers/char/serial167.c:62:
/usr/src/devel/arch/m68k/include/asm/pgtable_mm.h:148:1: warning: "pgprot_noncached" redefined
In file included from /usr/src/devel/arch/m68k/include/asm/pgtable_mm.h:138,
from /usr/src/devel/arch/m68k/include/asm/pgtable.h:4,
from include/linux/mm.h:40,
from drivers/char/serial167.c:62:include/asm-generic/pgtable.h:133:1: warning: this is the location of the previous definition
And in linux-next m68k allmodconfig is dead as a doornail:
drivers/staging/vme/Kconfig:5:warning: type of 'VME' redefined from 'boolean' to 'tristate' In file included from include/linux/irq.h:12,
from include/asm-generic/hardirq.h:6,
from /usr/src/devel/arch/m68k/include/asm/hardirq.h:4,
from include/linux/hardirq.h:10,
from /usr/src/devel/arch/m68k/include/asm/system_mm.h:69,
from /usr/src/devel/arch/m68k/include/asm/system.h:4,
from include/linux/list.h:7,
from include/linux/preempt.h:11,
from include/linux/spinlock.h:50,
from include/linux/seqlock.h:29,
from include/linux/time.h:8,
from include/linux/timex.h:56,
from include/linux/sched.h:56,
from arch/m68k/kernel/asm-offsets.c:12:
include/linux/smp.h:17: error: field 'list' has incomplete type
In file included from include/linux/mmzone.h:9,
from include/linux/gfp.h:4,
from include/linux/irq.h:20,
from include/asm-generic/hardirq.h:6,
from /usr/src/devel/arch/m68k/include/asm/hardirq.h:4,
from include/linux/hardirq.h:10,
from /usr/src/devel/arch/m68k/include/asm/system_mm.h:69,
from /usr/src/devel/arch/m68k/include/asm/system.h:4,
from include/linux/list.h:7,
from include/linux/preempt.h:11,
from include/linux/spinlock.h:50,
from include/linux/seqlock.h:29,
from include/linux/time.h:8,
from include/linux/timex.h:56,
from include/linux/sched.h:56,
from arch/m68k/kernel/asm-offsets.c:12:include/linux/wait.h:37: error: field 'task_list' has incomplete type include/linux/wait.h:51: error: expected specifier-qualifier-list before 'spinlock_t' include/linux/wait.h: In function 'waitqueue_active':include/linux/wait.h:108: error: implicit declaration of function 'list_empty' include/linux/wait.h:108: error: 'wait_queue_head_t' has no member named 'task_list' include/linux/wait.h: In function '__add_wait_queue':include/linux/wait.h:117: error: implicit declaration of function 'list_add' include/linux/wait.h:117: error: 'wait_queue_head_t' has no member named 'task_list' include/linux/wait.h: In function '__add_wait_queue_tail':include/linux/wait.h:126: error: implicit declaration of function 'list_add_tail' include/linux/wait.h:126: error: 'wait_queue_head_t' has no member named 'task_list' include/linux/wait.h: In function '__remove_wait_queue':include/linux/wait.h:132: error: implicit declaration of function 'list_del'
Quoted 3 lines · Andrew Morton
btw, m68k allmodconfig in current mainline is sick:
And in linux-next m68k allmodconfig is dead as a doornail:
Will look at it (eventually)...
But recovering from a too-long absence and replacing the computer that died before the absence
while keeping the mill of life running take its time...
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]
In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds