The patch titled
ISDN: correctly handle isdn_writebuf_stub() errors
has been removed from the -mm tree. Its filename is
isdn-unsafe-interaction-between-isdn_write-and-isdn_writebuf_stub.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: ISDN: correctly handle isdn_writebuf_stub() errors
From: Jesper Juhl <jesper.juhl@xxxxxxxxx>
isdn_writebuf_stub() forgets to detect memory allocation and uaccess errors.
And when that's fixed, if a error happens the caller will just keep on
looping.
So change the caller to detect the error, and to return it.
Signed-off-by: Jesper Juhl <jesper.juhl@xxxxxxxxx>
Cc: Karsten Keil <kkeil@xxxxxxx>
Signed-off-by: Tilman Schmidt <tilman@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
drivers/isdn/i4l/isdn_common.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff -puN drivers/isdn/i4l/isdn_common.c~isdn-unsafe-interaction-between-isdn_write-and-isdn_writebuf_stub drivers/isdn/i4l/isdn_common.c
--- a/drivers/isdn/i4l/isdn_common.c~isdn-unsafe-interaction-between-isdn_write-and-isdn_writebuf_stub
+++ a/drivers/isdn/i4l/isdn_common.c
@@ -1177,9 +1177,8 @@ isdn_write(struct file *file, const char
goto out;
}
chidx = isdn_minor2chan(minor);
- while (isdn_writebuf_stub(drvidx, chidx, buf, count) != count)
+ while ((retval = isdn_writebuf_stub(drvidx, chidx, buf, count)) == 0)
interruptible_sleep_on(&dev->drv[drvidx]->snd_waitq[chidx]);
- retval = count;
goto out;
}
if (minor <= ISDN_MINOR_CTRLMAX) {
@@ -1951,9 +1950,10 @@ isdn_writebuf_stub(int drvidx, int chan,
struct sk_buff *skb = alloc_skb(hl + len, GFP_ATOMIC);
if (!skb)
- return 0;
+ return -ENOMEM;
skb_reserve(skb, hl);
- copy_from_user(skb_put(skb, len), buf, len);
+ if (copy_from_user(skb_put(skb, len), buf, len))
+ return -EFAULT;
ret = dev->drv[drvidx]->interface->writebuf_skb(drvidx, chan, 1, skb);
if (ret <= 0)
dev_kfree_skb(skb);
_
Patches currently in -mm which might be from jesper.juhl@xxxxxxxxx are
origin.patch
fix-use-after-free-bug-in-cpia2-driver.patch
small-whitespace-cleanup-for-qlogic-driver.patch
add-scsi_add_host-failure-handling-for-nsp32.patch
ensure-null-deref-cant-possibly-happen-in-is_exported.patch
bluetooth-fix-potential-null-ptr-deref-in-dtl1_cscdtl1_hci_send_frame.patch
pnp-card_probe-fix-memory-leak.patch
moxa-remove-pointless-casts.patch
moxa-remove-pointless-check-of-tty-argument-vs-null.patch
moxa-partial-codingstyle-cleanup-spelling-fixes.patch
correct-sak-description-in-sysrqtxt.patch
i-force-joystick-remove-some-pointless-casts.patch
debug-shared-irqs.patch
remove-redundant-null-checks-before-free-in-fs.patch
remove-redundant-null-checks-before-free-in-kernel.patch
remove-redundant-null-checks-before-free-in-drivers.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
