linux-kernel - Re: [PATCH] media: drx: fix a missing check of return value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190107172231.49b549db@coco.lan>
Date:   Mon, 7 Jan 2019 17:22:31 -0200
From:   Mauro Carvalho Chehab <mchehab@...nel.org>
To:     Kangjie Lu <kjlu@....edu>
Cc:     pakki001@....edu, "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] media: drx: fix a missing check of return value

Em Thu, 20 Dec 2018 00:57:44 -0600
Kangjie Lu <kjlu@....edu> escreveu:

> Function drxj_dap_write_reg16(), which writes data to buffer, may fail.
> We need to check if it fails, and if so, we should goto error.

Did you test this on a real hardware? This kind of patch has a potential 
of breaking things, as, on some drivers, some writes may return error.

For example, when called on early stages, a write may fail because
the firmware was not loaded yet. So, a change like that should be
carefully tested with real hardware.

> Otherwise, the buffer will have incorrect data.
> 
> Signed-off-by: Kangjie Lu <kjlu@....edu>
> ---
>  drivers/media/dvb-frontends/drx39xyj/drxj.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/dvb-frontends/drx39xyj/drxj.c b/drivers/media/dvb-frontends/drx39xyj/drxj.c
> index 551b7d65fa66..d105125bc1c3 100644
> --- a/drivers/media/dvb-frontends/drx39xyj/drxj.c
> +++ b/drivers/media/dvb-frontends/drx39xyj/drxj.c
> @@ -2136,9 +2136,13 @@ int drxj_dap_atomic_read_write_block(struct i2c_device_addr *dev_addr,
>  
>  			word = ((u16) data[2 * i]);
>  			word += (((u16) data[(2 * i) + 1]) << 8);
> -			drxj_dap_write_reg16(dev_addr,
> +			rc = drxj_dap_write_reg16(dev_addr,
>  					     (DRXJ_HI_ATOMIC_BUF_START + i),
>  					    word, 0);
> +			if (rc) {
> +				pr_err("error %d\n", rc);
> +				goto rw_error;
> +			}
>  		}
>  	}
>  



Thanks,
Mauro