From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S936285AbcKKTLC (ORCPT ); Fri, 11 Nov 2016 14:11:02 -0500 Received: from mx2.suse.de ([195.135.220.15]:60802 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934591AbcKKTLB (ORCPT ); Fri, 11 Nov 2016 14:11:01 -0500 Date: Fri, 11 Nov 2016 20:10:56 +0100 From: "Luis R. Rodriguez" To: Yves-Alexis Perez Cc: linux-kernel@vger.kernel.org, johannes@sipsolutions.net, j@w1.fi, jslaby@suse.com, teg@jklm.no, kay@vrfy.org, jwboyer@fedoraproject.org, dmitry.torokhov@gmail.com, luto@amacapital.net, harald@redhat.com, seth.forshee@canonical.com, wagi@monom.org, "Luis R . Rodriguez" , Ming Lei , Bjorn Andersson , Greg Kroah-Hartman , stable@vger.kernel.org Subject: Re: [PATCH v2] firmware: fix async, manual firmware loading Message-ID: <20161111191056.GW13978@wotan.suse.de> References: <20161111153217.571-1-corsac@corsac.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20161111153217.571-1-corsac@corsac.net> User-Agent: Mutt/1.6.0 (2016-04-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Nov 11, 2016 at 04:32:17PM +0100, Yves-Alexis Perez wrote: > When wait_for_completion_interruptible_timeout() is called from > _request_firmware_load() with a large timeout value (here, MAX_JIFFY_OFFSET > because it's a an explicit call to the user helper), its return value (a > long) will overflow when silently casted to int, be stored as a negative > integer and then treated as an error. > > This bug was introduced in commit 68ff2a00dbf5 ("firmware_loader: handle > timeout via wait_for_completion_interruptible_timeout()") when a delay work > was replaced by the call to wait_for_completion_interruptible_timeout(). > > Fix this by re-using the timeout variable and only set retval in specific > cases. > > Signed-off-by: Yves-Alexis Perez > Fixes: 68ff2a00dbf5 "firmware_loader: handle timeout via wait_for_completion_interruptible_timeout()" > Cc: Luis R. Rodriguez > Cc: Ming Lei > Cc: Bjorn Andersson > Cc: Greg Kroah-Hartman > Cc: stable@vger.kernel.org > Acked-by: Luis R. Rodriguez > Reviewed-by: Bjorn Andersson Sorry this commit log still does not help kernel maintainers enough, we want them well informed immediately what the default behaviour is, what the impact of the issue is, how broad of an issue it is, how this issue is triggered and exactly how this can happen. I'll massage this a bit myself and re-submit, as otherwise this work will be done by each and every single Linux kernel maintainer working on a Linux distribution trying to determine if its correct to merge this into their tree or not. I'll re-submit shortly. Luis