diff mbox

[v2] radio-bcm2048.c: fix wrong overflow check

Message ID 20140422125726.GA30238@mwanda (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter April 22, 2014, 12:57 p.m. UTC
From: Pali Rohár <pali.rohar@gmail.com>

This patch fixes an off by one check in bcm2048_set_region().

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: Send it to the correct list.  Re-work the changelog.

This patch has been floating around for four months but Pavel and Pali
are knuckle-heads and don't know how to use get_maintainer.pl so they
never send it to linux-media.

Also Pali doesn't give reporter credit and Pavel steals authorship
credit.

Also when you try explain to them about how to send patches correctly
they complain that they have been trying but it is too much work so now
I have to do it.  During the past four months thousands of other people
have been able to send patches in the correct format to the correct list
but it is too difficult for Pavel and Pali...  *sigh*.

Comments

Jiri Kosina May 5, 2014, 1:34 p.m. UTC | #1
On Tue, 22 Apr 2014, Dan Carpenter wrote:

> From: Pali Rohár <pali.rohar@gmail.com>
> 
> This patch fixes an off by one check in bcm2048_set_region().
> 
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
> Signed-off-by: Pavel Machek <pavel@ucw.cz>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: Send it to the correct list.  Re-work the changelog.
> 
> This patch has been floating around for four months but Pavel and Pali
> are knuckle-heads and don't know how to use get_maintainer.pl so they
> never send it to linux-media.
> 
> Also Pali doesn't give reporter credit and Pavel steals authorship
> credit.
> 
> Also when you try explain to them about how to send patches correctly
> they complain that they have been trying but it is too much work so now
> I have to do it.  During the past four months thousands of other people
> have been able to send patches in the correct format to the correct list
> but it is too difficult for Pavel and Pali...  *sigh*.

Seems like it's not in linux-next as of today, so I am taking it now. 
Thanks,
Pali Rohár May 9, 2014, 4:10 p.m. UTC | #2
On Monday 05 May 2014 15:34:29 Jiri Kosina wrote:
> On Tue, 22 Apr 2014, Dan Carpenter wrote:
> > From: Pali Rohár <pali.rohar@gmail.com>
> > 
> > This patch fixes an off by one check in
> > bcm2048_set_region().
> > 
> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> > Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
> > Signed-off-by: Pavel Machek <pavel@ucw.cz>
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> > v2: Send it to the correct list.  Re-work the changelog.
> > 
> > This patch has been floating around for four months but
> > Pavel and Pali are knuckle-heads and don't know how to use
> > get_maintainer.pl so they never send it to linux-media.
> > 
> > Also Pali doesn't give reporter credit and Pavel steals
> > authorship credit.
> > 
> > Also when you try explain to them about how to send patches
> > correctly they complain that they have been trying but it
> > is too much work so now I have to do it.  During the past
> > four months thousands of other people have been able to
> > send patches in the correct format to the correct list but
> > it is too difficult for Pavel and Pali...  *sigh*.
> 
> Seems like it's not in linux-next as of today, so I am taking
> it now. Thanks,

I still do not see this patch in torvalds branch... So what is 
needed to include this security buffer overflow patch into 
mainline & stable kernels?
Hans Verkuil May 9, 2014, 5:13 p.m. UTC | #3
On 05/09/2014 06:10 PM, Pali Rohár wrote:
> On Monday 05 May 2014 15:34:29 Jiri Kosina wrote:
>> On Tue, 22 Apr 2014, Dan Carpenter wrote:
>>> From: Pali Rohár <pali.rohar@gmail.com>
>>>
>>> This patch fixes an off by one check in
>>> bcm2048_set_region().
>>>
>>> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>>> Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
>>> Signed-off-by: Pavel Machek <pavel@ucw.cz>
>>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>> ---
>>> v2: Send it to the correct list.  Re-work the changelog.
>>>
>>> This patch has been floating around for four months but
>>> Pavel and Pali are knuckle-heads and don't know how to use
>>> get_maintainer.pl so they never send it to linux-media.
>>>
>>> Also Pali doesn't give reporter credit and Pavel steals
>>> authorship credit.
>>>
>>> Also when you try explain to them about how to send patches
>>> correctly they complain that they have been trying but it
>>> is too much work so now I have to do it.  During the past
>>> four months thousands of other people have been able to
>>> send patches in the correct format to the correct list but
>>> it is too difficult for Pavel and Pali...  *sigh*.
>>
>> Seems like it's not in linux-next as of today, so I am taking
>> it now. Thanks,
> 
> I still do not see this patch in torvalds branch... So what is 
> needed to include this security buffer overflow patch into 
> mainline & stable kernels?
> 

Today I collected a pile of pending patches including this one and
posted a pull request on the linux-media mailinglist. Once Mauro picks
it up it will appear in our tree and then linux-next. He's been
travelling for the past two weeks, so he'll have a sizable backlog.

Just be patient, it's not forgotten.

Regards,

	Hans
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Jiri Kosina May 11, 2014, 9:06 p.m. UTC | #4
On Fri, 9 May 2014, Pali Rohár wrote:

> > Seems like it's not in linux-next as of today, so I am taking
> > it now. Thanks,
> 
> I still do not see this patch in torvalds branch... So what is 
> needed to include this security buffer overflow patch into 
> mainline & stable kernels?

I picked it up 4 days ago into trivial.git, which is a tree that doesn't 
get pushed to Linus really super-often.

Of course, if, in the meantime, this goes in through maintainer tree, even 
better.
diff mbox

Patch

diff --git a/drivers/staging/media/bcm2048/radio-bcm2048.c b/drivers/staging/media/bcm2048/radio-bcm2048.c
index b2cd3a8..bbf236e 100644
--- a/drivers/staging/media/bcm2048/radio-bcm2048.c
+++ b/drivers/staging/media/bcm2048/radio-bcm2048.c
@@ -737,7 +737,7 @@  static int bcm2048_set_region(struct bcm2048_device *bdev, u8 region)
 	int err;
 	u32 new_frequency = 0;
 
-	if (region > ARRAY_SIZE(region_configs))
+	if (region >= ARRAY_SIZE(region_configs))
 		return -EINVAL;
 
 	mutex_lock(&bdev->mutex);