The patch titled
ISDN: fix drivers, by handling errors thrown by ->readstat()
has been removed from the -mm tree. Its filename is
isdn-fix-drivers-by-handling-errors-thrown-by-readstat.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: ISDN: fix drivers, by handling errors thrown by ->readstat()
From: Jeff Garzik <jeff@xxxxxxxxxx>
This is a particularly ugly on-failure bug, possibly security, since the
lack of error handling here is covering up another class of bug: failure to
handle copy_to_user() return values.
The I4L API function ->readstat() returns an integer, and by looking at
several existing driver implementations, it is clear that a negative return
value was meant to indicate an error.
Given that several drivers already return a negative value indicating an
errno-style error, the current code would blindly accept that [negative]
value as a valid amount of bytes read. Obvious damage ensues.
Correcting ->readstat() handling to properly notice errors fixes the
existing code to work correctly on error, and enables future patches to
more easily indicate errors during operation.
Signed-off-by: Jeff Garzik <jeff@xxxxxxxxxx>
Cc: Karsten Keil <kkeil@xxxxxxx>
Cc: <stable@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
drivers/isdn/i4l/isdn_common.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff -puN drivers/isdn/i4l/isdn_common.c~isdn-fix-drivers-by-handling-errors-thrown-by-readstat drivers/isdn/i4l/isdn_common.c
--- a/drivers/isdn/i4l/isdn_common.c~isdn-fix-drivers-by-handling-errors-thrown-by-readstat
+++ a/drivers/isdn/i4l/isdn_common.c
@@ -1134,9 +1134,12 @@ isdn_read(struct file *file, char __user
if (dev->drv[drvidx]->interface->readstat) {
if (count > dev->drv[drvidx]->stavail)
count = dev->drv[drvidx]->stavail;
- len = dev->drv[drvidx]->interface->
- readstat(buf, count, drvidx,
- isdn_minor2chan(minor));
+ len = dev->drv[drvidx]->interface->readstat(buf, count,
+ drvidx, isdn_minor2chan(minor));
+ if (len < 0) {
+ retval = len;
+ goto out;
+ }
} else {
len = 0;
}
_
Patches currently in -mm which might be from jeff@xxxxxxxxxx are
origin.patch
e100-fix-reboot-f-with-netconsole-enabled.patch
fix-up-a-multitude-of-acpi-compiler-warnings-on-x86_64.patch
cpufreq-handle-sysfs-errors.patch
drm-fix-error-returns-sysfs-error-handling.patch
git-dvb.patch
input-handle-sysfs-errors.patch
input-drivers-handle-sysfs-errors.patch
git-libata-all.patch
ata-must-depend-on-block.patch
ahci-readability-tweak.patch
libata-sff-allow-for-wacky-systems.patch
libata-revamp-blacklist-support-to-allow-multiple-kinds.patch
pata_marvell-marvell-6101-6145-pata-driver.patch
via-pata-controller-xfer-fixes.patch
ahci-ati-sb600-sata-support-for-various-modes.patch
drivers-mmcmisc-handle-pci-errors-on-resume.patch
git-mtd.patch
git-netdev-all.patch
libphy-dont-do-that.patch
update-smc91x-driver-with-arm-versatile-board-info.patch
8139too-force-media-setting-fix.patch
tulip-fix-shutdown-dma-irq-race.patch
drivers-dma-handle-sysfs-errors.patch
atm-firestream-handle-thrown-error.patch
wan-pc300-handle-propagate-minor-errors.patch
net-atm-handle-sysfs-errors.patch
pcmcia-handle-sysfs-pci-errors.patch
r8169-driver-corega-support-patch.patch
serial-handle-pci_enable_device-failure-upon-resume.patch
git-pciseg.patch
scsi-minor-bug-fixes-and-cleanups.patch
mpt-fusion-handle-pci-layer-error-on-resume.patch
scsi-aha1740-handle-scsi-api-errors.patch
scsi-qla2xxx-handle-sysfs-errors.patch
usb-gadget-net2280-handle-sysfs-errors-fix.patch
git-watchdog.patch
airo-suspend-fix.patch
i2o-more-error-checking.patch
pnp-handle-sysfs-errors.patch
rtc-handle-sysfs-errors.patch
sound-oss-emu10k1-handle-userspace-copy-errors.patch
spi-improve-sysfs-compiler-complaint-handling.patch
remove-double-cast-to-same-type.patch
atyfb-rivafb-minor-fixes.patch
md-conditionalize-some-code.patch
user-of-the-jiffies-rounding-patch-ata-subsystem.patch
git-gccbug.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
