On Tue, Jul 10, 2018 at 01:34:59PM -0700, Jann Horn wrote: > On Sat, Jul 7, 2018 at 7:03 AM Greg Kroah-Hartman > <gre...@linuxfoundation.org> wrote: > > > > On Sat, Jul 07, 2018 at 10:29:26AM +0200, Samuel Thibault wrote: > > > Re, > > > > > > Could you review, test, and resubmit the patch below instead? > > > > > > Samuel > > > > > > > > > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, > > > causing > > > the loop to copy as much data as available to the provided buffer. If > > > softsynthx_read() is invoked through sys_splice(), this causes an > > > unbounded kernel write; but even when userspace just reads from it > > > normally, a small size could cause userspace crashes. > > > > > > Fixes: 425e586cf95b ("speakup: add unicode variant of /dev/softsynth") > > > Cc: sta...@vger.kernel.org > > > Signed-off-by: Samuel Thibault <samuel.thiba...@ens-lyon.org> > > > > You forgot a "reported-by:" line :( > > > > also, I already applied Jann's patch, so could you either just send the > > fixup, or a revert/add of this patch once you all agree on the proper > > solution here? > > I think my patch was garbage (as both Samuel and Dan Carpenter's > smatch warning pointed out) and should be reverted. Should I be > sending the revert?
I'll just go drop it, thanks for letting me know. greg k-h _______________________________________________ devel mailing list de...@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel