Re: Serial.c BUG 2.4.x-2.5x

From: Roman Kurakin (rik@cronyx.ru)
Date: Thu Mar 07 2002 - 08:53:25 EST


Hi,

Russell King wrote:

>On Fri, Mar 01, 2002 at 11:07:03AM -0800, Ed Vance wrote:
>
>>On Fri, Mar 01, 2002 at 4:19 AM, Roman Kurakin wrote:
>>
>>> Who is responsible person for applying [serial driver] patches
>>> to main tree?
>>>
>
>This particular bug has already been fixed in the rewrite, as I originally
>said back on 14 November 2001.
>
I remember this, I thought some one responsible for updating current
version of the main tree.
Now I see the reason this didn't get into recent stable versions.

>The patch does fine for the most part, but I have two worries:
>
>1. the possibilities of pushing through changes in the IO or memory space
> by changing the other space at the same time. (ie, port = 1, iomem =
> 0xfe007c00 and you already have a line at port = 0, iomem = 0xfe007c00).
> I delt with this properly using the resource management subsystem.
>
I think such code could solve this problem ...

- (rs_table[i].port == new_port) &&
+ ((rs_table[i].port && rs_table[i].port == new_port) ||
+ ((rs_table[i].iomem_base && rs_table[i].iomem_base == new_mem)) &&
 

>2. there seems to be a lack of security considerations for changing the
> iomem address. (ie, changing the iomem address without CAP_SYS_ADMIN.
> I added this as an extra check for change_port)
>
And this one could be fixed with something like this (this is no a
patch, just an idea)

        change_port = (new_port != ((int) state->port)) ||
                (new_serial.hub6 != state->hub6);
+ change_mem = (new_mem != state->iomem_base)

        if (!capable(CAP_SYS_ADMIN)) {
- if (change_irq || change_port ||
+ if (change_irq || change_port || change_mem

As I wrote I didn't check serial.c for all possible problems, I just
find one bug and suggested
the way it could be solved.

Best regards,
                        Roman Kurakin

>>I then asked Russell to set the rules for this co-ordination and no response
>>has been forthcoming. Perhaps he missed my question?
>>
>
>I have a fair bit of email backed up at the moment, but I have been in
>contact with Ted T'so recently. I won't say much more at the moment,
>but should have something in a month or two. Until then I'd rather not
>say too much publically.
>

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Thu Mar 07 2002 - 21:01:03 EST