Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-14 Thread Takashi Iwai
On Thu, 07 Apr 2016 11:20:02 +0200, Takashi Iwai wrote: > > On Fri, 01 Apr 2016 22:11:11 +0200, > Takashi Iwai wrote: > > > > On Fri, 01 Apr 2016 21:21:05 +0200, > > Al Viro wrote: > > > > > > On Fri, Apr 01, 2016 at 08:39:19PM +0200, Takashi Iwai wrote: > > > > > > > > /* Get packet from user

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-14 Thread Takashi Iwai
On Thu, 07 Apr 2016 11:20:02 +0200, Takashi Iwai wrote: > > On Fri, 01 Apr 2016 22:11:11 +0200, > Takashi Iwai wrote: > > > > On Fri, 01 Apr 2016 21:21:05 +0200, > > Al Viro wrote: > > > > > > On Fri, Apr 01, 2016 at 08:39:19PM +0200, Takashi Iwai wrote: > > > > > > > > /* Get packet from user

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-07 Thread Takashi Iwai
On Fri, 01 Apr 2016 22:11:11 +0200, Takashi Iwai wrote: > > On Fri, 01 Apr 2016 21:21:05 +0200, > Al Viro wrote: > > > > On Fri, Apr 01, 2016 at 08:39:19PM +0200, Takashi Iwai wrote: > > > > > > /* Get packet from user space buffer */ > > > static ssize_t tun_get_user(struct tun_struct *tun,

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-07 Thread Takashi Iwai
On Fri, 01 Apr 2016 22:11:11 +0200, Takashi Iwai wrote: > > On Fri, 01 Apr 2016 21:21:05 +0200, > Al Viro wrote: > > > > On Fri, Apr 01, 2016 at 08:39:19PM +0200, Takashi Iwai wrote: > > > > > > /* Get packet from user space buffer */ > > > static ssize_t tun_get_user(struct tun_struct *tun,

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-01 Thread Takashi Iwai
On Fri, 01 Apr 2016 21:21:05 +0200, Al Viro wrote: > > On Fri, Apr 01, 2016 at 08:39:19PM +0200, Takashi Iwai wrote: > > > > /* Get packet from user space buffer */ > > static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, > > void *msg_control,

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-01 Thread Takashi Iwai
On Fri, 01 Apr 2016 21:21:05 +0200, Al Viro wrote: > > On Fri, Apr 01, 2016 at 08:39:19PM +0200, Takashi Iwai wrote: > > > > /* Get packet from user space buffer */ > > static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, > > void *msg_control,

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-01 Thread Al Viro
On Fri, Apr 01, 2016 at 08:39:19PM +0200, Takashi Iwai wrote: > > /* Get packet from user space buffer */ > static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, > void *msg_control, struct iov_iter *from, > int noblock) >

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-01 Thread Al Viro
On Fri, Apr 01, 2016 at 08:39:19PM +0200, Takashi Iwai wrote: > > /* Get packet from user space buffer */ > static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, > void *msg_control, struct iov_iter *from, > int noblock) >

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-01 Thread Takashi Iwai
On Fri, 01 Apr 2016 19:39:20 +0200, Al Viro wrote: > > On Fri, Apr 01, 2016 at 05:02:04PM +0200, Takashi Iwai wrote: > > Currently, iov_iter_advance() just calls iterate_and_advance() macro > > as is, even if size=0 is passed. Usually it is OK to pass size=0 to > > the macro. However, when the

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-01 Thread Takashi Iwai
On Fri, 01 Apr 2016 19:39:20 +0200, Al Viro wrote: > > On Fri, Apr 01, 2016 at 05:02:04PM +0200, Takashi Iwai wrote: > > Currently, iov_iter_advance() just calls iterate_and_advance() macro > > as is, even if size=0 is passed. Usually it is OK to pass size=0 to > > the macro. However, when the

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-01 Thread Al Viro
On Fri, Apr 01, 2016 at 05:02:04PM +0200, Takashi Iwai wrote: > Currently, iov_iter_advance() just calls iterate_and_advance() macro > as is, even if size=0 is passed. Usually it is OK to pass size=0 to > the macro. However, when the iov_iter has been already advanced to > the end of the array,

Re: [PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-01 Thread Al Viro
On Fri, Apr 01, 2016 at 05:02:04PM +0200, Takashi Iwai wrote: > Currently, iov_iter_advance() just calls iterate_and_advance() macro > as is, even if size=0 is passed. Usually it is OK to pass size=0 to > the macro. However, when the iov_iter has been already advanced to > the end of the array,

[PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-01 Thread Takashi Iwai
Currently, iov_iter_advance() just calls iterate_and_advance() macro as is, even if size=0 is passed. Usually it is OK to pass size=0 to the macro. However, when the iov_iter has been already advanced to the end of the array, it may lead to an out-of-bound access, since the macro always reads

[PATCH v2] iov_iter: Fix out-of-bound access in iov_iter_advance()

2016-04-01 Thread Takashi Iwai
Currently, iov_iter_advance() just calls iterate_and_advance() macro as is, even if size=0 is passed. Usually it is OK to pass size=0 to the macro. However, when the iov_iter has been already advanced to the end of the array, it may lead to an out-of-bound access, since the macro always reads