linux-kernel - Re: [PATCH v2 2/2] staging/rtl8192e: userspace ptr deref + incorrect declarations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 4 May 2014 19:48:23 +0200
From:	Levente Kurusa <levex@...ux.com>
To:	Dominique van den Broeck <domdevlin@...e.fr>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 2/2] staging/rtl8192e: userspace ptr deref + incorrect
 declarations

Hi,

On Sun, May 04, 2014 at 04:46:27PM +0200, Dominique van den Broeck wrote:
> . userspace pointer dereference ;
> 

What is that period in the commit message? And the semicolon?
You should also be a bit more specific. Also, the Subject line is
very bad. Better go with something like this:

staging: rtl8192e: fix userspace pointer dereference

And when you resend a patchset, please resend the full patchset.

> These issues have been fixed by a concurrent patch:
> . missing inclusions of needed header files (fixed by concurrent patch);
> . unrequired static function declaration (confusing another *.c file).

This is totally unneccessary.

> 
> Signed-off-by: Dominique van den Broeck <domdevlin@...e.fr>
> ---
> v1 : I submit this patch as a result for Task #16 of the Eudyptula Challenge.
> v2 : Resubmitted because of a conflit with commit 5169af2309f42bb4cb0ebfefe6bf8bc888d4ce33 .
>      Successfully tested against commit b5c8d48bf8f4273a9fe680bd834f991005c8ab59 .
>      I resubmit only the 2/2 one, since the 1/2 as already been accepted.
> 
>      Levente, still agree with you about numeric values that should be changed into symbols.
>      This will form another future patch.

When you cite a commit please don't include the full hash, that is
non informational. Better put the first 7 characters of the hash and
the first line of the commit message as well in parantheses, like so:

5169af2 ("Staging: rtl8192e: Fix declaration of symbols")
(I even have a command for this in vim :-) )

Are you sure that 1/2 was applied to the staging tree?
It's unlikely that 1/2 is applied while 2/2 is left alone.

Oh, I am unable to find commit b5c8d48 in Linus' or staging-next.
In which tree is it?

> 
> diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
> index 498995d..d87cdfa 100644
> --- a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
> +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
> @@ -1131,11 +1131,18 @@ static int r8192_wx_set_PromiscuousMode(struct net_device *dev,
>  	struct r8192_priv *priv = rtllib_priv(dev);
>  	struct rtllib_device *ieee = priv->rtllib;
>  
> -	u32 *info_buf = (u32 *)(wrqu->data.pointer);
> +	u32 info_buf[3];

Could you please as well remove that empty line in the declarations?

>  
> -	u32 oid = info_buf[0];
> -	u32 bPromiscuousOn = info_buf[1];
> -	u32 bFilterSourceStationFrame = info_buf[2];
> +	u32 oid;
> +	u32 bPromiscuousOn;
> +	u32 bFilterSourceStationFrame;
> +
> +	if (copy_from_user(info_buf, wrqu->data.pointer, sizeof(info_buf)))
> +		return -EFAULT;
> +
> +	oid = info_buf[0];
> +	bPromiscuousOn = info_buf[1];
> +	bFilterSourceStationFrame = info_buf[2];
>  
>  	if (OID_RT_INTEL_PROMISCUOUS_MODE == oid) {
>  		ieee->IntelPromiscuousModeInfo.bPromiscuousOn =

--
Regards,
Levente Kurusa

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)