linux-kernel - Re: [PATCH] staging: line6: fix possible overrun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20140429172858.GD26890@mwanda>
Date:	Tue, 29 Apr 2014 20:28:58 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	Mateusz Guzik <mguzik@...hat.com>
Cc:	Takashi Iwai <tiwai@...e.de>, devel@...verdev.osuosl.org,
	gregkh@...uxfoundation.org,
	Laurent Navet <laurent.navet@...il.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] staging: line6: fix possible overrun

We have two options:
1) Do we risk introducing new truncation bugs.
2) Do we risk breaking the driver because we didn't catch every
   truncation bug.

Truncation bugs here are very low impact and probably no one would even
notice.  That's how not worried I am about truncation bugs in this
context.  It's also unlikely that we will introduce any new truncation
bugs.

Breaking the driver is very serious.  But on the other hand as soon as
you proposed introducing an -EINVAL, I reviewed the driver and found the
places which would break when the code was changed.  As a result of my
review then the likely hood of breakage is now low.

In other words both options are probably fine.  If someone is able to
test the -EINVAL change then I would be happy to have it.

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/