On Sat, Jul 07, 2018 at 10:29:26AM +0200, Samuel Thibault wrote: > Re, > > Could you review, test, and resubmit the patch below instead? > > Samuel > > > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > the loop to copy as much data as available to the provided buffer. If > softsynthx_read() is invoked through sys_splice(), this causes an > unbounded kernel write; but even when userspace just reads from it > normally, a small size could cause userspace crashes. > > Fixes: 425e586cf95b ("speakup: add unicode variant of /dev/softsynth") > Cc: sta...@vger.kernel.org > Signed-off-by: Samuel Thibault <samuel.thiba...@ens-lyon.org>
You forgot a "reported-by:" line :( also, I already applied Jann's patch, so could you either just send the fixup, or a revert/add of this patch once you all agree on the proper solution here? thanks, greg k-h