Re: [PATCH] Re: 2.6.10 : fs/openpromfs/inode.c : small mistakes makes module oops when writing

[Al Viro <viro@parcelfarce.linux.theplanet.co.uk>]

On Wed, Jan 05, 2005 at 04:39:21PM +0100, Vincent Pelletier wrote:
> Hello.
> 
> Here is the patch.
> 
> Changelog:
> 	2005/01/05  Vincent Pelletier  <subdino2004@yahoo.fr>
> 	inode.c: (nodenum_read, property_read, property_write):
> 	Protected against NULL parameters. property_read: Returns 0 when
> 	called with a 0-length buffer. (property_write): Don't expect an
> 	hex list to begin with a dot.

NAK.  Patch
	a) loses needed checks
	b) adds utterly bogus ones
	c) is much bigger than it should be

All it really takes is

diff -urN RC10-bk6-base/fs/openpromfs/inode.c RC10-bk6-current/fs/openpromfs/inode.c
--- RC10-bk6-base/fs/openpromfs/inode.c	2004-10-18 17:54:07.000000000 -0400
+++ RC10-bk6-current/fs/openpromfs/inode.c	2005-01-05 12:22:08.710924933 -0500
@@ -94,8 +94,6 @@
 	openprom_property *op;
 	char buffer[64];
 	
-	if (*ppos >= 0xffffff || count >= 0xffffff)
-		return -EINVAL;
 	if (!filp->private_data) {
 		node = nodes[(u16)((long)inode->u.generic_ip)].node;
 		i = ((u32)(long)inode->u.generic_ip) >> 16;
@@ -168,6 +166,8 @@
 		op = (openprom_property *)filp->private_data;
 	if (!count || !(op->len || (op->flag & OPP_ASCIIZ)))
 		return 0;
+	if (*ppos >= 0xffffff || count >= 0xffffff)
+		return -EINVAL;
 	if (op->flag & OPP_STRINGLIST) {
 		for (k = 0, p = op->value; p < op->value + op->len; p++)
 			if (!*p)