linux-kernel - Re: [PATCH 1/7] mmc: at91

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4C7AD3A0.40607@bluewatersys.com>
Date:	Mon, 30 Aug 2010 09:39:44 +1200
From:	Ryan Mallon <ryan@...ewatersys.com>
To:	Chris Ball <cjb@...top.org>
CC:	Nicolas Ferre <nicolas.ferre@...el.com>, linux-mmc@...r.kernel.org,
	linux-kernel@...r.kernel.org, avictor.za@...il.com,
	wolfgang.mues@...rswald.de, akpm@...ux-foundation.org,
	linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH 1/7] mmc: at91_mci: fix pointer errors

On 08/28/2010 07:33 AM, Chris Ball wrote:
> Hi Andrew, Nicolas,
> 
> On Fri, Feb 26, 2010 at 07:39:29PM +0100, Nicolas Ferre wrote:
>> From: Wolfgang Muees <wolfgang.mues@...rswald.de>
>>
>> Fixes two pointer errors, one which leads to memory overwrites if used with
>> large chunks of data.
>>
>> Signed-off-by: Wolfgang Muees <wolfgang.mues@...rswald.de>
>> Signed-off-by: Nicolas Ferre <nicolas.ferre@...el.com>
>> ---
>>  drivers/mmc/host/at91_mci.c |    8 +++++---
>>  1 files changed, 5 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/mmc/host/at91_mci.c b/drivers/mmc/host/at91_mci.c
>> index 63924e0..6835104 100644
>> --- a/drivers/mmc/host/at91_mci.c
>> +++ b/drivers/mmc/host/at91_mci.c
>> @@ -227,11 +227,13 @@ static inline void at91_mci_sg_to_dma(struct at91mci_host *host, struct mmc_data
>>  			for (index = 0; index < (amount / 4); index++)
>>  				*dmabuf++ = swab32(sgbuffer[index]);
>>  		} else {
>> -			memcpy(dmabuf, sgbuffer, amount);
>> -			dmabuf += amount;
>> +			char *tmpv = (char *)dmabuf;
>> +			memcpy(tmpv, sgbuffer, amount);
>> +			tmpv += amount;
>> +			dmabuf = (unsigned *)tmpv;

I see this is already applied, but why all the type trickery here? Why
not just:

	memcpy(dmabuf, sgbuffer, amount);
	dmabuf += amount / sizeof(dmabuf);

>>  		}
>>  
>> -		kunmap_atomic(sgbuffer, KM_BIO_SRC_IRQ);
>> +		kunmap_atomic(((void *)sgbuffer)-sg->offset, KM_BIO_SRC_IRQ);

void * arithmetic is a gcc-ism. Isn't it better to cast to char *, since
the meaning will be a bit more clear.

~Ryan

-- 
Bluewater Systems Ltd - ARM Technology Solution Centre

Ryan Mallon         		5 Amuri Park, 404 Barbadoes St
ryan@...ewatersys.com         	PO Box 13 889, Christchurch 8013
http://www.bluewatersys.com	New Zealand
Phone: +64 3 3779127		Freecall: Australia 1800 148 751
Fax:   +64 3 3779135			  USA 1800 261 2934
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/