linux-kernel - [PATCH] staging: android: ashmem: Fix zero area size return code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 23 Sep 2019 16:54:51 +0200
From:   "Christopher N. Hesse" <raymanfx@...il.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     penguin-kernel@...ove.SAKURA.ne.jp,
        "Christopher N. Hesse" <raymanfx@...il.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Arve Hjønnevåg <arve@...roid.com>,
        Todd Kjos <tkjos@...roid.com>,
        Martijn Coenen <maco@...roid.com>,
        Joel Fernandes <joel@...lfernandes.org>,
        Christian Brauner <christian@...uner.io>,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org
Subject: [PATCH] staging: android: ashmem: Fix zero area size return code

The previous inline comment stated that a size of zero would make the
ashmem_read_iter function return EOF, but it returned 0 instead.

Looking at other functions, such as ashmem_llseek or ashmem_mmap, it
appears the convention is to return -EINVAL if the region size is unset or
zero.

To be consistent with the checks, I changed the one occurrence that used
the ! operator to compare the size to check against equal-to-zero instead.

Signed-off-by: Christopher N. Hesse <raymanfx@...il.com>
---
 drivers/staging/android/ashmem.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 74d497d39c5a..6af8130db0d7 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -291,9 +291,11 @@ static ssize_t ashmem_read_iter(struct kiocb *iocb, struct iov_iter *iter)
 
 	mutex_lock(&ashmem_mutex);
 
-	/* If size is not set, or set to 0, always return EOF. */
-	if (asma->size == 0)
+	/* If size is not set, or set to 0, always return EINVAL. */
+	if (asma->size == 0) {
+		ret = -EINVAL;
 		goto out_unlock;
+	}
 
 	if (!asma->file) {
 		ret = -EBADF;
@@ -359,7 +361,7 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
 	mutex_lock(&ashmem_mutex);
 
 	/* user needs to SET_SIZE before mapping */
-	if (!asma->size) {
+	if (asma->size == 0) {
 		ret = -EINVAL;
 		goto out;
 	}
-- 
2.23.0