Messages in this thread | | | Date | Sat, 7 Jul 2018 16:03:43 +0200 | From | Greg Kroah-Hartman <> | Subject | Re: [PATCH] staging: speakup: fix wraparound in uaccess length check |
| |
On Sat, Jul 07, 2018 at 10:29:26AM +0200, Samuel Thibault wrote: > Re, > > Could you review, test, and resubmit the patch below instead? > > Samuel > > > If softsynthx_read() is called with `count < 3`, `count - 3` wraps, causing > the loop to copy as much data as available to the provided buffer. If > softsynthx_read() is invoked through sys_splice(), this causes an > unbounded kernel write; but even when userspace just reads from it > normally, a small size could cause userspace crashes. > > Fixes: 425e586cf95b ("speakup: add unicode variant of /dev/softsynth") > Cc: stable@vger.kernel.org > Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
You forgot a "reported-by:" line :(
also, I already applied Jann's patch, so could you either just send the fixup, or a revert/add of this patch once you all agree on the proper solution here?
thanks,
greg k-h
| |