Re: [PATCH] intel_th: Fix a missing-check bug

2018-10-30 Thread Alexander Shishkin
Wenwen Wang writes: > Hello, > > Can anyone confirm this bug? Thanks! Commonly this burden lies with the author of the patch. If you fix a bug, you need to be able to demonstrate it. If it's a mere hypothesis, there needs to be a detailed analysis of how exactly can this be exploited and what

Re: [PATCH] intel_th: Fix a missing-check bug

2018-10-30 Thread Alexander Shishkin
Wenwen Wang writes: > Hello, > > Can anyone confirm this bug? Thanks! Commonly this burden lies with the author of the patch. If you fix a bug, you need to be able to demonstrate it. If it's a mere hypothesis, there needs to be a detailed analysis of how exactly can this be exploited and what

Re: [PATCH] intel_th: Fix a missing-check bug

2018-10-29 Thread Wenwen Wang
Hello, Can anyone confirm this bug? Thanks! Wenwen On Fri, Oct 19, 2018 at 8:47 AM Wenwen Wang wrote: > > In msc_data_sz(), the 'valid_dw' field of the msc block descriptor 'bdesc' > is firstly checked to see whether the descriptor has a valid data width. If > yes, i.e., 'bdesc->valid_dw' is

Re: [PATCH] intel_th: Fix a missing-check bug

2018-10-29 Thread Wenwen Wang
Hello, Can anyone confirm this bug? Thanks! Wenwen On Fri, Oct 19, 2018 at 8:47 AM Wenwen Wang wrote: > > In msc_data_sz(), the 'valid_dw' field of the msc block descriptor 'bdesc' > is firstly checked to see whether the descriptor has a valid data width. If > yes, i.e., 'bdesc->valid_dw' is

[PATCH] intel_th: Fix a missing-check bug

2018-10-19 Thread Wenwen Wang
In msc_data_sz(), the 'valid_dw' field of the msc block descriptor 'bdesc' is firstly checked to see whether the descriptor has a valid data width. If yes, i.e., 'bdesc->valid_dw' is not 0, the data size of this descriptor will be returned. It is worth noting that the data size is calculated from

[PATCH] intel_th: Fix a missing-check bug

2018-10-19 Thread Wenwen Wang
In msc_data_sz(), the 'valid_dw' field of the msc block descriptor 'bdesc' is firstly checked to see whether the descriptor has a valid data width. If yes, i.e., 'bdesc->valid_dw' is not 0, the data size of this descriptor will be returned. It is worth noting that the data size is calculated from