Re: FW: [PATCH] cs5535_gpio: Fix root triggerable integer underflow

[Michael Buesch <mb@bu3sch.de>]

On Friday 24 July 2009 19:40:28 Ben Gardner wrote:
> Hi Michael,
> 
> > This patch fixes a possible root triggerable (I hope the device is only
> > readable by root?) integer underflow.
> > Well, it's not really an underflow, but as loff_t is a signed type, the
> > range check at the start of the function is incomplete. It needs to
> > check for <0, too.
> > Otherwise the loop below will poke into random memory and I/O space.
> > This could be used to crash the machine, at least.
> >
> > This patch is only compiletested, because I do not have the hardware.
> >
> > Signed-off-by: Michael Buesch <mb@bu3sch.de>
> >
> > ---
> >
> > I'm not sure if this bug is exploitable. I _guess_ the device is only
> > readable by root
> > on a standard setup.
> 
> The cs5525_gpio driver uses the default seek, which doesn't allow
> negative position values.
> So, I don't think it necessary to check for negative values.

Yes you are right.

-- 
Greetings, Michael.