From: Johannes Stezenbach <js@linuxtv.org>
To: linux-kernel@vger.kernel.org
Cc: Andrew Morton <akpm@osdl.org>, Linus Torvalds <torvalds@osdl.org>,
Michael Hunold <hunold@linuxtv.org>
Subject: [PATCH] fix dvb-net Oops
Date: Mon, 13 Dec 2004 17:03:09 +0100 [thread overview]
Message-ID: <20041213160309.GA12700@linuxtv.org> (raw)
Hi,
emard<at>softhome!net discovered an embarrasing bug in
dvb_net.c where the NET_REMOVE_IF ioctl will cause an
Oops when called with an invalid interface number.
The patch applies on top of the other dvb patches in linux-2.6.10-rc3-mm1
and should go into 2.6.10.
Signed-off-by: Johannes Stezenbach <js@linuxtv.org>
Johannes
--- linux-2.6.10-rc3-mm1/drivers/media/dvb/dvb-core/dvb_net.c.orig 2004-12-13 15:12:51.000000000 +0100
+++ linux-2.6.10-rc3-mm1/drivers/media/dvb/dvb-core/dvb_net.c 2004-12-13 15:34:28.000000000 +0100
@@ -1201,13 +1201,14 @@ static int dvb_net_add_if(struct dvb_net
}
-static int dvb_net_remove_if(struct dvb_net *dvbnet, int num)
+static int dvb_net_remove_if(struct dvb_net *dvbnet, unsigned int num)
{
struct net_device *net = dvbnet->device[num];
- struct dvb_net_priv *priv = net->priv;
+ struct dvb_net_priv *priv;
if (!dvbnet->state[num])
return -EINVAL;
+ priv = net->priv;
if (priv->in_use)
return -EBUSY;
@@ -1268,10 +1269,18 @@ static int dvb_net_do_ioctl(struct inode
break;
}
case NET_REMOVE_IF:
+ {
+ int ret;
+
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
- module_put(dvbdev->adapter->module);
- return dvb_net_remove_if(dvbnet, (int) (long) parg);
+ if ((unsigned int) parg >= DVB_NET_DEVICES_MAX)
+ return -EINVAL;
+ ret = dvb_net_remove_if(dvbnet, (unsigned int) parg);
+ if (!ret)
+ module_put(dvbdev->adapter->module);
+ return ret;
+ }
/* binary compatiblity cruft */
case __NET_ADD_IF_OLD:
reply other threads:[~2004-12-13 16:04 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20041213160309.GA12700@linuxtv.org \
--to=js@linuxtv.org \
--cc=akpm@osdl.org \
--cc=hunold@linuxtv.org \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@osdl.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).