On 12/9/18 9:40 PM, David Miller wrote:
> From: Mathias Payer
> Date: Sun, 9 Dec 2018 21:17:58 +0100
>
>> I've attached the updated patch. (Greg, please add your Signed-off-by).
>
> Patches should be posted inline, not as attachments as per
> process/submitting-p
Signed-off-by).
Best,
Mathias
commit 78e4a03cd3ae7c8f5957a170bc054fd89d7600f1
Author: Mathias Payer
Date: Sun Dec 9 16:45:09 2018 +0100
NET: hso: Fix OOB memory access in hso_probe/hso_get_config_data in hso.c
From: Hui Peng
The function hso_probe reads if_num from the
Hi David,
>> +} else {
>> port_spec = hso_get_config_data(interface);
>> +if (IS_ERR_VALUE((long)port_spec))
>> +goto exit;
>
> 'port_spec' is an 'int', it makes no sense to cast it 3 times all the
> way back to 'int' to figure out if it is a negat
in hso_probe or hso_get_config_data. Added a length check for both locations
> and updated hso_probe to bail on error.
>
> Reported-by: Hui Peng
> Reported-by: Mathias Payer
> Signed-off-by: Hui Peng
> Signed-off-by: Mathias Payer
> Signed-off-by: Greg Kroah-Hartman
