From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752518AbdJFTAm (ORCPT <rfc822;w@1wt.eu>);
        Fri, 6 Oct 2017 15:00:42 -0400
Received: from lb2-smtp-cloud7.xs4all.net ([194.109.24.28]:37999 "EHLO
        lb2-smtp-cloud7.xs4all.net" rhost-flags-OK-OK-OK-OK)
        by vger.kernel.org with ESMTP id S1751484AbdJFTAk (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 6 Oct 2017 15:00:40 -0400
Message-ID: <1507316433.6960.19.camel@tiscali.nl>
Subject: Re: [PATCH v2] isdn/gigaset: Convert timers to use timer_setup()
From: Paul Bolle <pebolle@tiscali.nl>
To: Kees Cook <keescook@chromium.org>
Cc: Karsten Keil <isdn@linux-pingi.de>,
        "David S. Miller" <davem@davemloft.net>,
        Johan Hovold <johan@kernel.org>, linux-kernel@vger.kernel.org,
        gigaset307x-common@lists.sourceforge.net, netdev@vger.kernel.org
Date: Fri, 06 Oct 2017 21:00:33 +0200
In-Reply-To: <20171005193118.GA105874@beast>
References: <20171005193118.GA105874@beast>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.24.5 (3.24.5-1.fc26) 
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
X-CMAE-Envelope: MS4wfH3CinYwC65Y9kKIOXQEcT7BFt/QdaCwmGgdDaiCKVdMyUDW1ikXKIJyXfgZVOfLQbwPP0FG5k39brfNNTSzxE3LIkLPWbRvKNEiaworakInzPXsewTp
 ibX9/4ImqRJfgvE1O3LEQ7FgAtyRO1WCYywIC8qOyvt37Jvx6RXHApgR/vMK8HshFSh7onR/pq8FoN7ku+XxTyEmkuM9D+WZx3G4hiR9BqWqyBQ8jxFzNv0G
 WNl1yIfeRaK/WcWJivGwl7Wu/xbjv6sDF1PLVByq6b9DhmJ802Z6T6toWIi1sypxRUBYGyYjhjkhk+Nq83DH60Qk7JQjdy3ARFOs0WzFbnAEM4h5wZHqyP5Q
 7IpJtWMaD+IpnuQVqIpotS8aAaU8bA==
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, 2017-10-05 at 12:31 -0700, Kees Cook wrote:
> --- a/drivers/isdn/gigaset/bas-gigaset.c
> +++ b/drivers/isdn/gigaset/bas-gigaset.c

> -static void cmd_in_timeout(unsigned long data)
> +static void cmd_in_timeout(struct timer_list *t)
>  {
> -	struct cardstate *cs = (struct cardstate *) data;
> -	struct bas_cardstate *ucs = cs->hw.bas;
> +	struct bas_cardstate *ucs = from_timer(ucs, t, timer_cmd_in);
> +	struct urb *urb = ucs->urb_int_in;
> +	struct cardstate *cs = urb->context;

This makes me nervous. Are you sure urb->context points to a struct cardstate
here and in the other two places this patch changes?

Anyhow, I'd like to have some time to do my review. So what's your timeframe
here? I do hope I have at least a few weeks. (In other words: I hope gigaset
isn't the only driver where the ability to use random pointers in these timer
callbacks is removed.)

Thanks,


Paul Bolle