* [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
@ 2013-12-20 9:49 Qixue Xiao
0 siblings, 0 replies; 5+ messages in thread
From: Qixue Xiao @ 2013-12-20 9:49 UTC (permalink / raw)
To: linux-kernel; +Cc: xiaoqixue_1, xuyongjiande, chyyuu
there is an overflow in the code :
cyz_polling_cycle = (arg * HZ) / 1000,
the multiplicator arg comes from user, so it may be an overflow if
arg is a big number. And the value of cyc_polling_cycle will be
wrong when it is used next time.
Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
Suggested-by: Yu Chen <chyyuu@gmail.com>
Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
---
drivers/tty/cyclades.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
index 33f83fe..a57bb5a 100644
--- a/drivers/tty/cyclades.c
+++ b/drivers/tty/cyclades.c
@@ -2709,6 +2709,8 @@ cy_ioctl(struct tty_struct *tty,
break;
#ifndef CONFIG_CYZ_INTR
case CYZSETPOLLCYCLE:
+ if (arg > LONG_MAX / HZ)
+ return -ENODEV;
cyz_polling_cycle = (arg * HZ) / 1000;
break;
case CYZGETPOLLCYCLE:
--
1.7.9.5
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
2013-12-18 1:00 xqx12
@ 2013-12-19 0:57 ` Greg KH
0 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2013-12-19 0:57 UTC (permalink / raw)
To: xqx12; +Cc: jslaby, linux-kernel, chyyuu, xuyongjiande, xqx12
On Wed, Dec 18, 2013 at 09:00:29AM +0800, xqx12 wrote:
> there is an overflow in the code :
> cyz_polling_cycle = (arg * HZ) / 1000,
> the multiplicator arg comes from user, so it may be an overflow if
> arg is a big number. And the value of cyc_polling_cycle will be
> wrong when it is used next time.
>
> Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
> Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
> Suggested-by: Yu Chen <chyyuu@gmail.com>
> Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
I need a "real" name as the "From:" line here, especially as it doesn't
match any of these lines either :(
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
@ 2013-12-18 1:00 xqx12
2013-12-19 0:57 ` Greg KH
0 siblings, 1 reply; 5+ messages in thread
From: xqx12 @ 2013-12-18 1:00 UTC (permalink / raw)
To: gregkh, jslaby; +Cc: linux-kernel, chyyuu, xuyongjiande, xqx12
there is an overflow in the code :
cyz_polling_cycle = (arg * HZ) / 1000,
the multiplicator arg comes from user, so it may be an overflow if
arg is a big number. And the value of cyc_polling_cycle will be
wrong when it is used next time.
Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
Suggested-by: Yu Chen <chyyuu@gmail.com>
Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
---
drivers/tty/cyclades.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
index 33f83fe..a57bb5a 100644
--- a/drivers/tty/cyclades.c
+++ b/drivers/tty/cyclades.c
@@ -2709,6 +2709,8 @@ cy_ioctl(struct tty_struct *tty,
break;
#ifndef CONFIG_CYZ_INTR
case CYZSETPOLLCYCLE:
+ if (arg > LONG_MAX / HZ)
+ return -ENODEV;
cyz_polling_cycle = (arg * HZ) / 1000;
break;
case CYZGETPOLLCYCLE:
--
1.7.9.5
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
2013-12-16 14:21 xqx12
@ 2013-12-17 17:39 ` Greg KH
0 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2013-12-17 17:39 UTC (permalink / raw)
To: xqx12; +Cc: jslaby, linux-kernel, chyyuu, xuyongjiande, xqx12
On Mon, Dec 16, 2013 at 10:21:36PM +0800, xqx12 wrote:
> there is an overflow in the code :
> cyz_polling_cycle = (arg * HZ) / 1000,
> the multiplicator arg comes from user, so it may be an overflow if
> arg is a big number. And the value of cyc_polling_cycle will be
> wrong when it is used next time.
>
> Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
> Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
> Suggested-by: Yu Chen <chyyuu@gmail.com>
> Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
> ---
> drivers/tty/cyclades.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
> index cfeec97..7eec1c5 100644
> --- a/drivers/tty/cyclades.c
> +++ b/drivers/tty/cyclades.c
> @@ -2728,7 +2728,8 @@ cy_ioctl(struct tty_struct *tty,
> break;
> #ifndef CONFIG_CYZ_INTR
> case CYZSETPOLLCYCLE:
> + if (arg > LONG_MAX / HZ)
> + return -ENODEV;
This patch fails to apply at all to any of my trees, can you please redo
it against the latest tty tree and resend it so that I can apply it?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c
@ 2013-12-16 14:21 xqx12
2013-12-17 17:39 ` Greg KH
0 siblings, 1 reply; 5+ messages in thread
From: xqx12 @ 2013-12-16 14:21 UTC (permalink / raw)
To: gregkh, jslaby; +Cc: linux-kernel, chyyuu, xuyongjiande, xqx12
there is an overflow in the code :
cyz_polling_cycle = (arg * HZ) / 1000,
the multiplicator arg comes from user, so it may be an overflow if
arg is a big number. And the value of cyc_polling_cycle will be
wrong when it is used next time.
Reported-by: Qixue Xiao <xiaoqixue_1@163.com>
Suggested-by: Yongjian Xu <xuyongjiande@gmail.com>
Suggested-by: Yu Chen <chyyuu@gmail.com>
Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com>
---
drivers/tty/cyclades.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
index cfeec97..7eec1c5 100644
--- a/drivers/tty/cyclades.c
+++ b/drivers/tty/cyclades.c
@@ -2728,7 +2728,8 @@ cy_ioctl(struct tty_struct *tty,
break;
#ifndef CONFIG_CYZ_INTR
case CYZSETPOLLCYCLE:
+ if (arg > LONG_MAX / HZ)
+ return -ENODEV;
cyz_polling_cycle = (arg * HZ) / 1000;
break;
case CYZGETPOLLCYCLE:
--
1.7.9.5
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-12-20 9:49 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-12-20 9:49 [PATCH] tty: an overflow of multiplication in drivers/tty/cyclades.c Qixue Xiao
-- strict thread matches above, loose matches on Subject: below --
2013-12-18 1:00 xqx12
2013-12-19 0:57 ` Greg KH
2013-12-16 14:21 xqx12
2013-12-17 17:39 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).