* [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
@ 2013-12-18 1:00 xqx12
2013-12-19 0:57 ` Greg KH
0 siblings, 1 reply; 6+ messages in thread
From: xqx12 @ 2013-12-18 1:00 UTC (permalink / raw)
To: gregkh, jslaby; +Cc: linux-kernel, chyyuu, xuyongjiande, xqx12
there is an overflow in the code :
cyz_polling_cycle = (arg * HZ) / 1000,
the multiplicator arg comes from user, so it may be an overflow if
arg is a big number. And the value of cyc_polling_cycle will be
wrong when it is used next time.
Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
Suggested-by: Yu Chen <chyyuu@gmail.com>
Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
---
drivers/tty/cyclades.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
index 33f83fe..a57bb5a 100644
--- a/drivers/tty/cyclades.c
+++ b/drivers/tty/cyclades.c
@@ -2709,6 +2709,8 @@ cy_ioctl(struct tty_struct *tty,
break;
#ifndef CONFIG_CYZ_INTR
case CYZSETPOLLCYCLE:
+ if (arg > LONG_MAX / HZ)
+ return -ENODEV;
cyz_polling_cycle = (arg * HZ) / 1000;
break;
case CYZGETPOLLCYCLE:
--
1.7.9.5
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
2013-12-18 1:00 [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c xqx12
@ 2013-12-19 0:57 ` Greg KH
2013-12-19 10:12 ` xiaoqixue_1
0 siblings, 1 reply; 6+ messages in thread
From: Greg KH @ 2013-12-19 0:57 UTC (permalink / raw)
To: xqx12; +Cc: jslaby, linux-kernel, chyyuu, xuyongjiande, xqx12
On Wed, Dec 18, 2013 at 09:00:29AM +0800, xqx12 wrote:
> there is an overflow in the code :
> cyz_polling_cycle = (arg * HZ) / 1000,
> the multiplicator arg comes from user, so it may be an overflow if
> arg is a big number. And the value of cyc_polling_cycle will be
> wrong when it is used next time.
>
> Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
> Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
> Suggested-by: Yu Chen <chyyuu@gmail.com>
> Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
I need a "real" name as the "From:" line here, especially as it doesn't
match any of these lines either :(
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re:Re: [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
2013-12-19 0:57 ` Greg KH
@ 2013-12-19 10:12 ` xiaoqixue_1
0 siblings, 0 replies; 6+ messages in thread
From: xiaoqixue_1 @ 2013-12-19 10:12 UTC (permalink / raw)
To: Greg KH; +Cc: xqx12, jslaby, linux-kernel, chyyuu, xuyongjiande
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=us-ascii, Size: 980 bytes --]
I am sorry for it because my git configure is not sound.
my real name Qixue Xiao , and my email <xiaoqixue_1@163.com>.
At 2013-12-19 08:57:40,"Greg KH" <gregkh@linuxfoundation.org> wrote:
>On Wed, Dec 18, 2013 at 09:00:29AM +0800, xqx12 wrote:
>> there is an overflow in the code :
>> cyz_polling_cycle = (arg * HZ) / 1000,
>> the multiplicator arg comes from user, so it may be an overflow if
>> arg is a big number. And the value of cyc_polling_cycle will be
>> wrong when it is used next time.
>>
>> Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
>> Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
>> Suggested-by: Yu Chen <chyyuu@gmail.com>
>> Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
>
>I need a "real" name as the "From:" line here, especially as it doesn't
>match any of these lines either :(
>
ÿôèº{.nÇ+‰·Ÿ®‰†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a¢f£¢·hšïêÿ‘êçz_è®\x03(階ŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨èÚ&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
@ 2013-12-20 9:49 Qixue Xiao
0 siblings, 0 replies; 6+ messages in thread
From: Qixue Xiao @ 2013-12-20 9:49 UTC (permalink / raw)
To: linux-kernel; +Cc: xiaoqixue_1, xuyongjiande, chyyuu
there is an overflow in the code :
cyz_polling_cycle = (arg * HZ) / 1000,
the multiplicator arg comes from user, so it may be an overflow if
arg is a big number. And the value of cyc_polling_cycle will be
wrong when it is used next time.
Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
Suggested-by: Yu Chen <chyyuu@gmail.com>
Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
---
drivers/tty/cyclades.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
index 33f83fe..a57bb5a 100644
--- a/drivers/tty/cyclades.c
+++ b/drivers/tty/cyclades.c
@@ -2709,6 +2709,8 @@ cy_ioctl(struct tty_struct *tty,
break;
#ifndef CONFIG_CYZ_INTR
case CYZSETPOLLCYCLE:
+ if (arg > LONG_MAX / HZ)
+ return -ENODEV;
cyz_polling_cycle = (arg * HZ) / 1000;
break;
case CYZGETPOLLCYCLE:
--
1.7.9.5
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
2013-12-16 14:21 xqx12
@ 2013-12-17 17:39 ` Greg KH
0 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2013-12-17 17:39 UTC (permalink / raw)
To: xqx12; +Cc: jslaby, linux-kernel, chyyuu, xuyongjiande, xqx12
On Mon, Dec 16, 2013 at 10:21:36PM +0800, xqx12 wrote:
> there is an overflow in the code :
> cyz_polling_cycle = (arg * HZ) / 1000,
> the multiplicator arg comes from user, so it may be an overflow if
> arg is a big number. And the value of cyc_polling_cycle will be
> wrong when it is used next time.
>
> Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
> Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
> Suggested-by: Yu Chen <chyyuu@gmail.com>
> Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
> ---
> drivers/tty/cyclades.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
> index cfeec97..7eec1c5 100644
> --- a/drivers/tty/cyclades.c
> +++ b/drivers/tty/cyclades.c
> @@ -2728,7 +2728,8 @@ cy_ioctl(struct tty_struct *tty,
> break;
> #ifndef CONFIG_CYZ_INTR
> case CYZSETPOLLCYCLE:
> + if (arg > LONG_MAX / HZ)
> + return -ENODEV;
This patch fails to apply at all to any of my trees, can you please redo
it against the latest tty tree and resend it so that I can apply it?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
@ 2013-12-16 14:21 xqx12
2013-12-17 17:39 ` Greg KH
0 siblings, 1 reply; 6+ messages in thread
From: xqx12 @ 2013-12-16 14:21 UTC (permalink / raw)
To: gregkh, jslaby; +Cc: linux-kernel, chyyuu, xuyongjiande, xqx12
there is an overflow in the code :
cyz_polling_cycle = (arg * HZ) / 1000,
the multiplicator arg comes from user, so it may be an overflow if
arg is a big number. And the value of cyc_polling_cycle will be
wrong when it is used next time.
Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
Suggested-by: Yu Chen <chyyuu@gmail.com>
Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
---
drivers/tty/cyclades.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
index cfeec97..7eec1c5 100644
--- a/drivers/tty/cyclades.c
+++ b/drivers/tty/cyclades.c
@@ -2728,7 +2728,8 @@ cy_ioctl(struct tty_struct *tty,
break;
#ifndef CONFIG_CYZ_INTR
case CYZSETPOLLCYCLE:
+ if (arg > LONG_MAX / HZ)
+ return -ENODEV;
cyz_polling_cycle = (arg * HZ) / 1000;
break;
case CYZGETPOLLCYCLE:
--
1.7.9.5
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-12-20 9:49 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-12-18 1:00 [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c xqx12
2013-12-19 0:57 ` Greg KH
2013-12-19 10:12 ` xiaoqixue_1
-- strict thread matches above, loose matches on Subject: below --
2013-12-20 9:49 Qixue Xiao
2013-12-16 14:21 xqx12
2013-12-17 17:39 ` Greg KH
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.