Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Thu, Jul 12, 2018 at 04:12:39PM -0700, Jann Horn wrote: > On Thu, Jul 12, 2018 at 3:47 PM Al Viro wrote: > > > > On Fri, Jul 13, 2018 at 12:29:36AM +0200, Jann Horn wrote: > > > From: Samuel Thibault > > > > > > From: Samuel Thibault > > > > > > If softsynthx_read() is called with `count <

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Thu, Jul 12, 2018 at 04:12:39PM -0700, Jann Horn wrote: > On Thu, Jul 12, 2018 at 3:47 PM Al Viro wrote: > > > > On Fri, Jul 13, 2018 at 12:29:36AM +0200, Jann Horn wrote: > > > From: Samuel Thibault > > > > > > From: Samuel Thibault > > > > > > If softsynthx_read() is called with `count <

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Thu, Jul 12, 2018 at 3:47 PM Al Viro wrote: > > On Fri, Jul 13, 2018 at 12:29:36AM +0200, Jann Horn wrote: > > From: Samuel Thibault > > > > From: Samuel Thibault > > > > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > > the loop to copy as much data as

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Thu, Jul 12, 2018 at 3:47 PM Al Viro wrote: > > On Fri, Jul 13, 2018 at 12:29:36AM +0200, Jann Horn wrote: > > From: Samuel Thibault > > > > From: Samuel Thibault > > > > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > > the loop to copy as much data as

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Fri, Jul 13, 2018 at 12:29:36AM +0200, Jann Horn wrote: > From: Samuel Thibault > > From: Samuel Thibault > > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > the loop to copy as much data as available to the provided buffer. If > softsynthx_read() is invoked

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Fri, Jul 13, 2018 at 12:29:36AM +0200, Jann Horn wrote: > From: Samuel Thibault > > From: Samuel Thibault > > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > the loop to copy as much data as available to the provided buffer. If > softsynthx_read() is invoked

[PATCH] staging: speakup: fix wraparound in uaccess length check

From: Samuel Thibault From: Samuel Thibault If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing the loop to copy as much data as available to the provided buffer. If softsynthx_read() is invoked through sys_splice(), this causes an unbounded kernel write; but even when

[PATCH] staging: speakup: fix wraparound in uaccess length check

From: Samuel Thibault From: Samuel Thibault If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing the loop to copy as much data as available to the provided buffer. If softsynthx_read() is invoked through sys_splice(), this causes an unbounded kernel write; but even when

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

Hello, Jann Horn, le mar. 10 juil. 2018 13:34:33 -0700, a ecrit: > On Sat, Jul 7, 2018 at 1:29 AM Samuel Thibault > wrote: > > Could you review, test, and resubmit the patch below instead? > > Er... you mean, you want me to take your patch, add my Signed-off-by > below yours, and then send

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

Hello, Jann Horn, le mar. 10 juil. 2018 13:34:33 -0700, a ecrit: > On Sat, Jul 7, 2018 at 1:29 AM Samuel Thibault > wrote: > > Could you review, test, and resubmit the patch below instead? > > Er... you mean, you want me to take your patch, add my Signed-off-by > below yours, and then send

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Tue, Jul 10, 2018 at 01:34:59PM -0700, Jann Horn wrote: > On Sat, Jul 7, 2018 at 7:03 AM Greg Kroah-Hartman > wrote: > > > > On Sat, Jul 07, 2018 at 10:29:26AM +0200, Samuel Thibault wrote: > > > Re, > > > > > > Could you review, test, and resubmit the patch below instead? > > > > > > Samuel >

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Tue, Jul 10, 2018 at 01:34:59PM -0700, Jann Horn wrote: > On Sat, Jul 7, 2018 at 7:03 AM Greg Kroah-Hartman > wrote: > > > > On Sat, Jul 07, 2018 at 10:29:26AM +0200, Samuel Thibault wrote: > > > Re, > > > > > > Could you review, test, and resubmit the patch below instead? > > > > > > Samuel >

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Sat, Jul 7, 2018 at 7:03 AM Greg Kroah-Hartman wrote: > > On Sat, Jul 07, 2018 at 10:29:26AM +0200, Samuel Thibault wrote: > > Re, > > > > Could you review, test, and resubmit the patch below instead? > > > > Samuel > > > > > > If softsynthx_read() is called with `count < 3`, `count - 3`

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Sat, Jul 7, 2018 at 7:03 AM Greg Kroah-Hartman wrote: > > On Sat, Jul 07, 2018 at 10:29:26AM +0200, Samuel Thibault wrote: > > Re, > > > > Could you review, test, and resubmit the patch below instead? > > > > Samuel > > > > > > If softsynthx_read() is called with `count < 3`, `count - 3`

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Sat, Jul 7, 2018 at 1:29 AM Samuel Thibault wrote: > > Re, > > Could you review, test, and resubmit the patch below instead? Er... you mean, you want me to take your patch, add my Signed-off-by below yours, and then send that? > Samuel > > > If softsynthx_read() is called with `count < 3`,

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Sat, Jul 7, 2018 at 1:29 AM Samuel Thibault wrote: > > Re, > > Could you review, test, and resubmit the patch below instead? Er... you mean, you want me to take your patch, add my Signed-off-by below yours, and then send that? > Samuel > > > If softsynthx_read() is called with `count < 3`,

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Sat, Jul 07, 2018 at 10:29:26AM +0200, Samuel Thibault wrote: > Re, > > Could you review, test, and resubmit the patch below instead? > > Samuel > > > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > the loop to copy as much data as available to the provided

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Sat, Jul 07, 2018 at 10:29:26AM +0200, Samuel Thibault wrote: > Re, > > Could you review, test, and resubmit the patch below instead? > > Samuel > > > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > the loop to copy as much data as available to the provided

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

Jann Horn, le sam. 07 juil. 2018 10:22:52 +0200, a ecrit: > Or should I rewrite the > patch to be simple and just bail out on `count < 3`? Our mails have crossed :) I believe what I sent is correct: for softsynth it does not make sense to have room for less than 1 (non-unicode) or 3 (unicode)

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

Jann Horn, le sam. 07 juil. 2018 10:22:52 +0200, a ecrit: > Or should I rewrite the > patch to be simple and just bail out on `count < 3`? Our mails have crossed :) I believe what I sent is correct: for softsynth it does not make sense to have room for less than 1 (non-unicode) or 3 (unicode)

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

Re, Could you review, test, and resubmit the patch below instead? Samuel If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing the loop to copy as much data as available to the provided buffer. If softsynthx_read() is invoked through sys_splice(), this causes an unbounded

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

Re, Could you review, test, and resubmit the patch below instead? Samuel If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing the loop to copy as much data as available to the provided buffer. If softsynthx_read() is invoked through sys_splice(), this causes an unbounded

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Sat, Jul 7, 2018 at 10:13 AM Samuel Thibault wrote: > > Jann Horn, le sam. 07 juil. 2018 03:53:44 +0200, a ecrit: > > @@ -257,6 +257,8 @@ static ssize_t softsynthx_read(struct file *fp, char > > __user *buf, size_t count, > > 0x80 | (ch & 0x3f) > >

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Sat, Jul 7, 2018 at 10:13 AM Samuel Thibault wrote: > > Jann Horn, le sam. 07 juil. 2018 03:53:44 +0200, a ecrit: > > @@ -257,6 +257,8 @@ static ssize_t softsynthx_read(struct file *fp, char > > __user *buf, size_t count, > > 0x80 | (ch & 0x3f) > >

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

Jann Horn, le sam. 07 juil. 2018 03:53:44 +0200, a ecrit: > @@ -257,6 +257,8 @@ static ssize_t softsynthx_read(struct file *fp, char > __user *buf, size_t count, > 0x80 | (ch & 0x3f) > }; > > + if (chars_sent + 2 > count) >

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

Jann Horn, le sam. 07 juil. 2018 03:53:44 +0200, a ecrit: > @@ -257,6 +257,8 @@ static ssize_t softsynthx_read(struct file *fp, char > __user *buf, size_t count, > 0x80 | (ch & 0x3f) > }; > > + if (chars_sent + 2 > count) >

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Sat, Jul 07, 2018 at 03:53:44AM +0200, Jann Horn wrote: > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > the loop to copy as much data as available to the provided buffer. If > softsynthx_read() is invoked through sys_splice(), this causes an > unbounded kernel

Re: [PATCH] staging: speakup: fix wraparound in uaccess length check

On Sat, Jul 07, 2018 at 03:53:44AM +0200, Jann Horn wrote: > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > the loop to copy as much data as available to the provided buffer. If > softsynthx_read() is invoked through sys_splice(), this causes an > unbounded kernel

[PATCH] staging: speakup: fix wraparound in uaccess length check

If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing the loop to copy as much data as available to the provided buffer. If softsynthx_read() is invoked through sys_splice(), this causes an unbounded kernel write; but even when userspace just reads from it normally, a small

[PATCH] staging: speakup: fix wraparound in uaccess length check

If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing the loop to copy as much data as available to the provided buffer. If softsynthx_read() is invoked through sys_splice(), this causes an unbounded kernel write; but even when userspace just reads from it normally, a small