Prev: [04/11] md/raid10: fix deadlock with unaligned read during resync
Next: [10/11] bdi: register sysfs bdi device only once per queue
From: Greg KH on 11 Aug 2010 20:00
2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: H. Peter Anvin <hpa(a)zytor.com>

commit a01c7800420d2c294ca403988488a635d4087a6d upstream.

In nvram_write, first of all, correctly handle the case where the file
pointer is already beyond the end; we should return EOF in that case.

Second, make the logic a bit more explicit so that gcc can statically
prove that the copy_from_user() is safe. Once the condition of the
beyond-end filepointer is eliminated, the copy is safe but gcc can't
prove it, causing build failures for i386 allyesconfig.

Third, eliminate the entirely superfluous variable "len", and just use
the passed-in variable "count" instead.

Signed-off-by: H. Peter Anvin <hpa(a)zytor.com>
Cc: Arjan van de Ven <arjan(a)infradead.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Wim Van Sebroeck <wim(a)iguana.be>
Cc: Frederic Weisbecker <fweisbec(a)gmail.com>
LKML-Reference: <tip-*@git.kernel.org>
Cc: Stephen Hemminger <shemminger(a)vyatta.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

---
drivers/char/nvram.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)

--- a/drivers/char/nvram.c
+++ b/drivers/char/nvram.c
@@ -265,10 +265,16 @@ nvram_write(struct file *file, const cha
unsigned char contents[NVRAM_BYTES];
unsigned i = *ppos;
unsigned char *tmp;
- int len;

- len = (NVRAM_BYTES - i) < count ? (NVRAM_BYTES - i) : count;
- if (copy_from_user(contents, buf, len))
+ if (i >= NVRAM_BYTES)
+ return 0; /* Past EOF */
+
+ if (count > NVRAM_BYTES - i)
+ count = NVRAM_BYTES - i;
+ if (count > NVRAM_BYTES)
+ return -EFAULT; /* Can't happen, but prove it to gcc */
+
+ if (copy_from_user(contents, buf, count))
return -EFAULT;

spin_lock_irq(&rtc_lock);
@@ -276,7 +282,7 @@ nvram_write(struct file *file, const cha
if (!__nvram_check_checksum())
goto checksum_err;

- for (tmp = contents; count-- > 0 && i < NVRAM_BYTES; ++i, ++tmp)
+ for (tmp = contents; count--; ++i, ++tmp)
__nvram_write_byte(*tmp, i);

__nvram_set_checksum();


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: [04/11] md/raid10: fix deadlock with unaligned read during resync
Next: [10/11] bdi: register sysfs bdi device only once per queue