RE: Serial.c BUG 2.4.x-2.5x

[Ed Vance <EdV@macrolink.com>]

Thanks Russell and Roman for your helpful input. I'll look at it today and
resubmit for further discussion.

Ed Vance

Roman Kurakin wrote:

> Russell King wrote:
> 
> >The patch does fine for the most part, but I have two worries:
> >
> >1. the possibilities of pushing through changes in the IO or memory space
> >   by changing the other space at the same time. (ie, port = 1, iomem =
> >   0xfe007c00 and you already have a line at port = 0, iomem =
0xfe007c00).
> >   I delt with this properly using the resource management subsystem.
> >
> I think such code could solve this problem ...
> 
> - 			    (rs_table[i].port == new_port) &&
> + 			    ((rs_table[i].port && rs_table[i].port ==
new_port) ||
> +			    ((rs_table[i].iomem_base &&
rs_table[i].iomem_base == new_mem)) &&
>  
> 
> >2. there seems to be a lack of security considerations for changing the
> >   iomem address.  (ie, changing the iomem address without CAP_SYS_ADMIN.
> >   I added this as an extra check for change_port)
> >
> And this one could be fixed with something like this (this is no a 
> patch, just an idea)
> 
>         change_port = (new_port != ((int) state->port)) ||
>                 (new_serial.hub6 != state->hub6);
> +        change_mem = (new_mem != state->iomem_base)
> 
>         if (!capable(CAP_SYS_ADMIN)) {
> -                if (change_irq || change_port ||
> +                if (change_irq || change_port || change_mem
> 

---------------------------------------------------------------- 
Ed Vance              serial24@macrolink.com
Macrolink, Inc.       1500 N. Kellogg Dr  Anaheim, CA  92807
----------------------------------------------------------------