From: Greg KH <greg@kroah.com>
To: torvalds@transmeta.com
Cc: linux-kernel@vger.kernel.org, pcihpd-discuss@lists.sourceforge.net
Subject: [PATCH] PCI Hotplug core bugfix
Date: Mon, 19 Nov 2001 22:19:03 -0800 [thread overview]
Message-ID: <20011119221903.D3736@kroah.com> (raw)
Hi,
Here's a patch against 2.4.15-pre7 that fixes a potential overflow
problem in the PCI Hotplug core code. Thanks to Andrew Morton for
pointing this out to me.
thanks,
greg k-h
diff --minimal -Nru a/drivers/hotplug/pci_hotplug_core.c b/drivers/hotplug/pci_hotplug_core.c
--- a/drivers/hotplug/pci_hotplug_core.c Mon Nov 19 20:55:21 2001
+++ b/drivers/hotplug/pci_hotplug_core.c Mon Nov 19 20:55:21 2001
@@ -622,7 +622,7 @@
static ssize_t power_write_file (struct file *file, const char *ubuff, size_t count, loff_t *offset)
{
struct hotplug_slot *slot = file->private_data;
- const char *buff;
+ char *buff;
unsigned long lpower;
u8 power;
int retval = 0;
@@ -639,10 +639,11 @@
return -ENODEV;
}
- buff = kmalloc (count, GFP_KERNEL);
+ buff = kmalloc (count + 1, GFP_KERNEL);
if (!buff)
return -ENOMEM;
-
+ memset (buff, 0x00, count + 1);
+
if (copy_from_user ((void *)buff, (void *)ubuff, count)) {
retval = -EFAULT;
goto exit;
@@ -732,7 +733,7 @@
static ssize_t attention_write_file (struct file *file, const char *ubuff, size_t count, loff_t *offset)
{
struct hotplug_slot *slot = file->private_data;
- const char *buff;
+ char *buff;
unsigned long lattention;
u8 attention;
int retval = 0;
@@ -749,9 +750,10 @@
return -ENODEV;
}
- buff = kmalloc (count, GFP_KERNEL);
+ buff = kmalloc (count + 1, GFP_KERNEL);
if (!buff)
return -ENOMEM;
+ memset (buff, 0x00, count + 1);
if (copy_from_user ((void *)buff, (void *)ubuff, count)) {
retval = -EFAULT;
@@ -868,7 +870,7 @@
static ssize_t test_write_file (struct file *file, const char *ubuff, size_t count, loff_t *offset)
{
struct hotplug_slot *slot = file->private_data;
- const char *buff;
+ char *buff;
unsigned long ltest;
u32 test;
int retval = 0;
@@ -885,9 +887,10 @@
return -ENODEV;
}
- buff = kmalloc (count, GFP_KERNEL);
+ buff = kmalloc (count + 1, GFP_KERNEL);
if (!buff)
return -ENOMEM;
+ memset (buff, 0x00, count + 1);
if (copy_from_user ((void *)buff, (void *)ubuff, count)) {
retval = -EFAULT;
reply other threads:[~2001-11-20 5:21 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20011119221903.D3736@kroah.com \
--to=greg@kroah.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pcihpd-discuss@lists.sourceforge.net \
--cc=torvalds@transmeta.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).