Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1688384

[PATCH 3.16 175/178] char: lp: fix possible integer overflow in lp_setup()

Show all headers | View raw

3.16.46-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Willy Tarreau <w@1wt.eu>

commit 3e21f4af170bebf47c187c1ff8bf155583c9f3b1 upstream.

The lp_setup() code doesn't apply any bounds checking when passing
"lp=none", and only in this case, resulting in an overflow of the
parport_nr[] array. All versions in Git history are affected.

Reported-By: Roee Hay <roee.hay@hcl.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/char/lp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -859,7 +859,11 @@ static int __init lp_setup (char *str)
 	} else if (!strcmp(str, "auto")) {
 		parport_nr[0] = LP_PARPORT_AUTO;
 	} else if (!strcmp(str, "none")) {
-		parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+		if (parport_ptr < LP_NO)
+			parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+		else
+			printk(KERN_INFO "lp: too many ports, %s ignored.\n",
+			       str);
 	} else if (!strcmp(str, "reset")) {
 		reset = 1;
 	}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.16 000/178] 3.16.46-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 077/178] s390/decompressor: fix initrd corruption  caused by bss clear Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 132/178] metag/usercopy: Set flags before ADDZ Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 024/178] [media] dvb-usb-firmware: don't do DMA on stack Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 144/178] x86/vdso: Ensure vdso32_enabled gets set to  valid values only Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 168/178] macvlan: Fix device ref leak when purging  bc_queue Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 048/178] futex: Add missing error handling to  FUTEX_REQUEUE_PI Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 123/178] l2tp: take reference on sessions being dumped Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 056/178] Input: iforce - validate number of endpoints  before using them Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 073/178] net: unix: properly re-increment inflight  counter of GC discarded candidates Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  Re: [PATCH 3.16 000/178] 3.16.46-rc1 review Guenter Roeck <linux@roeck-us.net> - 2017-07-16 16:40 +0200
    Re: [PATCH 3.16 000/178] 3.16.46-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 18:40 +0200
  [PATCH 3.16 007/178] batman-adv: Keep fragments equally sized Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 107/178] drm/vmwgfx: Remove getparam error message Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 072/178] ALSA: seq: Fix racy cell insertions during  snd_seq_pool_done() Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 055/178] mmc: ushc: fix NULL-deref at probe Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 136/178] Reset TreeId to zero on SMB2 TREE_CONNECT Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 175/178] char: lp: fix possible integer overflow in  lp_setup() Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:40 +0200
  [PATCH 3.16 044/178] usb-core: Add LINEAR_FRAME_INTR_BINTERVAL  USB quirk Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 070/178] ALSA: ctxfi: Fix the incorrect check of  dma_set_mask() call Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 087/178] ALSA: seq: Fix race during FIFO resize Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 086/178] hwmon: (asus_atk0110) fix uninitialized data  access Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 066/178] usb: hub: Fix crash after failure to read  BOS descriptor Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 166/178] net: ipv6: send unsolicited NA if enabled  for all interfaces Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 006/178] tracing: Add #undef to fix compile error Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 004/178] kprobes/x86: Fix kernel panic when certain  exception-handling addresses are probed Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 170/178] ipv6: move stub initialization after ipv6  setup completion Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 025/178] USB: iowarrior: fix NULL-deref in write Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 150/178] cpupower: Fix turbo frequency reporting for  pre-Sandy Bridge cores Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 176/178] fs/exec.c: account for argv/envp pointers Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 127/178] ring-buffer: Fix return value check in  test_ringbuffer() Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 015/178] Input: i8042 - add noloop quirk for Dell  Embedded Box PC 3000 Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 167/178] Input: i8042 - add Clevo P650RS to the i8042  reset list Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 050/178] iio: adc: ti_am335x_adc: fix fifo overrun  recovery Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 049/178] ext4: mark inode dirty after converting  inline directory Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200
  [PATCH 3.16 116/178] include/linux/kernel.h: change abs() macro  so it uses consistent return type Ben Hutchings <ben@decadent.org.uk> - 2017-07-16 16:50 +0200

csiph-web