linux-kernel - drivers/char/specialix.c: broken baud conversion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 9 Oct 2006 00:18:19 +0200
From:	Adrian Bunk <bunk@...sta.de>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>
Cc:	linux-kernel@...r.kernel.org, R.E.Wolff@...Wizard.nl
Subject: drivers/char/specialix.c: broken baud conversion

Hi Alan,

your commit commit 67cc0161ecc9ebee6eba4af6cbfdba028090b1b9
"specialix - remove private speed decoding" converted the variable baud 
from an index in the array baud_table[] to containing the baud value 
itself.

Unfortunately, it contains at least two bugs:

The Coverity checker spotted that the following line was forgotten:

           baud = (baud_table[baud] + 5) / 10;   /* Estimated CPS */

BTW: After the trivial fix, baud_table[] could be removed.

While looking at the patch, I noticed it contains another bug that is 
not that easy to fix:

-       if (baud == 15) {
+       if (baud == 38400) {
                if ((port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
                        baud ++;
                if ((port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_VHI)
                        baud += 2;
        }

Increasing the index for baud_table[] by 1 or 2 is quite different from 
increasing baud by 1 or 2.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/