From: Linus Torvalds <torvalds@linuxfoundation.org>
To: Salvatore Bonaccorso <carnil@debian.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
Stefan Richter <stefanr@s5r6.in-berlin.de>,
Luo Likang <luolikang@nsfocus.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Linux Media Mailing List <linux-media@vger.kernel.org>,
linux1394-devel@lists.sourceforge.net,
Yang Yanchao <yangyanchao6@huawei.com>,
Security Officers <security@kernel.org>,
linux-distros@vs.openwall.org
Subject: Re: [PATCH v2 RESEND] media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
Date: Sun, 12 Sep 2021 11:26:10 -0700 [thread overview]
Message-ID: <CAHk-=wjOW3Fx8td1Snezd1_9sf8q7KuQx8TyQNR0ypS2rVBHtg@mail.gmail.com> (raw)
In-Reply-To: <YT39LBTgGL/b/V5N@eldamar.lan>
On Sun, Sep 12, 2021 at 6:14 AM Salvatore Bonaccorso <carnil@debian.org> wrote:
>
> On Wed, Sep 01, 2021 at 01:40:26PM +0300, Dan Carpenter wrote:
> > On Mon, Aug 16, 2021 at 10:27:22AM +0300, Dan Carpenter wrote:
> > > The bounds checking in avc_ca_pmt() is not strict enough. It should
> > > be checking "read_pos + 4" because it's reading 5 bytes. If the
> > > "es_info_length" is non-zero then it reads a 6th byte so there needs to
> > > be an additional check for that.
> > >
> > > I also added checks for the "write_pos". I don't think these are
> > > required because "read_pos" and "write_pos" are tied together so
> > > checking one ought to be enough.
They may be in sync at a fixed offset, but the buffer length of the
read ("int length") is not in sync with the buffer length for the
write ("sizeof(c->operand)").
So I do think the write pos limit checking is actually necessary and needed.
> > > RESEND: this patch got lost somehow.
> >
> > What the heck? Someone on patchwork just marked this patch as obsolete
> > again!!!
Can we please make sure patchwork has some logging so that that kind
of thing shows _who_ did this?
> Someone knows what is going on here, i.e. what is the problem?
Dan, can you just send that fix to me directly, with the fixed commit
message (see above), and we can close this.
That still leaves the "who closes things on patchwork" question, but
that's something I can't do anything about.
Linus
next prev parent reply other threads:[~2021-09-12 18:26 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <000001d73031$d5304480$7f90cd80$@nsfocus.com>
2021-04-14 8:57 ` [PATCH] media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() Dan Carpenter
2021-04-19 21:42 ` Kees Cook
2021-06-07 15:23 ` [PATCH v2] " Dan Carpenter
2021-07-16 9:28 ` Petr Mladek
2021-07-19 10:25 ` [PATCH] " Dan Carpenter
2021-07-29 10:32 ` Greg KH
2021-08-16 7:01 ` Salvatore Bonaccorso
2021-08-16 7:27 ` [PATCH v2 RESEND] " Dan Carpenter
2021-09-01 10:40 ` Dan Carpenter
2021-09-12 13:14 ` Salvatore Bonaccorso
2021-09-12 18:26 ` Linus Torvalds [this message]
2021-09-13 2:50 ` Michael Ellerman
2021-09-13 13:23 ` Mauro Carvalho Chehab
2021-09-19 18:45 ` Salvatore Bonaccorso
2021-10-11 7:04 ` Salvatore Bonaccorso
2021-10-11 9:42 ` [PATCH] " Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHk-=wjOW3Fx8td1Snezd1_9sf8q7KuQx8TyQNR0ypS2rVBHtg@mail.gmail.com' \
--to=torvalds@linuxfoundation.org \
--cc=carnil@debian.org \
--cc=dan.carpenter@oracle.com \
--cc=linux-distros@vs.openwall.org \
--cc=linux-media@vger.kernel.org \
--cc=linux1394-devel@lists.sourceforge.net \
--cc=luolikang@nsfocus.com \
--cc=mchehab@kernel.org \
--cc=security@kernel.org \
--cc=stefanr@s5r6.in-berlin.de \
--cc=yangyanchao6@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).