On Thu, Sep 26, 2019 at 09:02:07AM -0700, Joe Perches wrote:
> > the [a-f0-9]{1,40} already excludes "commit".
>
> No it doesn't as commit starts with c which matches [a-f0-9]{1,40}
Whoops! Yes, sorry, you're right. I needed a trailing whitespace in the
regex.
--
Kees Cook
On Thu, Sep 26, 2019 at 08:14:03AM -0700, Joe Perches wrote:
> On Wed, 2019-09-25 at 11:40 -0700, Kees Cook wrote:
> > Is "6" a safe lower bound here? I thought 12 was the way to go?
> []
> > $ git log | egrep 'Fixes: [a-f0-9]{1,40}' | col2 | awk '{prin
On Wed, Sep 25, 2019 at 10:13:37AM -0700, Joe Perches wrote:
> On Thu, 2019-09-19 at 09:56 +0300, Dan Carpenter wrote:
> > When I sent a patch, I use get_maintainer.pl then I add whoever the
> > wrote the commit from the Fixes tag. Then I remove Colin King and Kees
> >
maybe in my RFC only the html
target would get the "real" file?
--
Kees Cook
having duplicated instructions at the top of both files),
which I see is what Joe suggested too.
> +.. include:: ../../MAINTAINERS
> + :literal:
Nah, let's do a full make target as you'd suggested back in that thread.
I'll give it a shot if you don't beat me to it. :)
--
Kees Cook
example, to create symlinks for
> all profile docs into a "study" directory.
>
> > The #2 case is helped by having them all in one directory with a single
> > index.rst, etc. Then similar profiles are able to merge, etc.
Whatever the case, please don't let me distract from the actual content
of these profiles: I think it's awesome to capture these details and
makes my life so much easier. :)
--
Kees Cook
ry in Documentation/, since there are
two ways someone would want to read profiles:
1) a single profile, based on a MAINTAINERS entry which includes the path
2) all of them, to study for various reasons
The #2 case is helped by having them all in one directory with a single
index.rst, etc. Then simi
;< 31 : 0;
use:
- keyup = (gpio & ir->mask_keyup) ? 1 << 31 : 0;
+ keyup = (gpio & ir->mask_keyup) ? BIT(31) : 0;
--
Kees Cook
o be working on fixing this. At a
glance, this patch appears to be more complete in that it makes the code
flow more sane too.
Reviewed-by: Kees Cook
-Kees
> ---
> drivers/media/usb/dvb-usb/technisat-usb2.c | 22 ++
> 1 file changed, 10 insertions(+), 12 deletions(-)
&
vers/net/ethernet/sun/sunhme.c | 4 ++--
> drivers/scsi/qlogicpti.h | 2 +-
> fs/notify/inotify/inotify_user.c | 2 +-
> kernel/irq/timings.c | 2 +-
> lib/vsprintf.c| 2 +-
> net/core/skbuff.c | 2 +-
> 17 files changed, 33 insertions(+), 31 deletions(-)
>
> --
> 2.19.1
>
--
Kees Cook
On Mon, Sep 10, 2018 at 11:34 AM, Mauro Carvalho Chehab
wrote:
> Em Mon, 10 Sep 2018 09:18:05 -0700
> Kees Cook escreveu:
>
>> On Mon, Sep 10, 2018 at 5:19 AM, Mauro Carvalho Chehab
>> wrote:
>> > The strncpy() function is being deprecated upstream. Replac
7;s trailing
NUL-padding to clear a buffer of prior contents.
How did you validate that for these changes?
-Kees
--
Kees Cook
Pixel Security
r *ptr;
}
strscpy(instance->buffer, source, sizeof(instance->buffer));
is correct.
But:
strscpy(instance->ptr, source, sizeof(instance->ptr));
will not be and will truncate strings to sizeof(char *).
If you _did_ verify this, I'd love to know more about your tooling. :)
-Ke
eturn value meaning between strlcpy() and strscpy()
differs).
Reviewed-by: Kees Cook
-Kees
--
Kees Cook
Pixel Security
ff-by: Sami Tolvanen
I think this actually makes things much more readable in the end. Thanks!
Reviewed-by: Kees Cook
-Kees
> ---
> drivers/media/v4l2-core/v4l2-ioctl.c | 72 ++--
> 1 file changed, 46 insertions(+), 26 deletions(-)
>
> diff --git a/driver
On Fri, Apr 27, 2018 at 12:54 PM, Sami Tolvanen wrote:
> This change fixes function types for media device ioctls to avoid
> indirect call mismatches with Control-Flow Integrity checking.
>
> Signed-off-by: Sami Tolvanen
Thanks for sending these!
Reviewed-by: Kees
ach_array_element - Iterate all items in an array
> + * @elem: pointer of array type for iteration cursor
> + * @array: array to be iterated
> + */
> +#define for_each_array_element(elem, array) \
> + for (elem = &(array)[0]; \
> +elem < &(array)[ARRAY_SIZE(array)]; \
> +++elem)
> +
> #define u64_to_user_ptr(x) ( \
> { \
> typecheck(u64, x); \
> --
> 2.7.4
>
--
Kees Cook
Pixel Security
On Fri, Nov 3, 2017 at 3:17 PM, Dmitry Torokhov
wrote:
> On Thu, Nov 02, 2017 at 10:16:58PM -0200, Mauro Carvalho Chehab wrote:
>> Em Thu, 2 Nov 2017 16:50:37 -0700
>> Dmitry Torokhov escreveu:
>>
>> > On Thu, Nov 02, 2017 at 04:24:27PM -0700, Kees Cook wrote:
>&
mit_keyup, 0);
>
> input_dev = input_allocate_device();
> if (!input_dev)
> @@ -365,8 +344,13 @@ int av7110_ir_init(struct av7110 *av7110)
> input_free_device(input_dev);
> return err;
> }
> - input_dev->timer.function = input_repeat_key;
> - input_dev->timer.data = (unsigned long) &av7110->ir;
> +
> + /*
> +* Input core's default autorepeat is 33 cps with 250 msec
> +* delay, let's adjust to numbers more suitable for remote
> +* control.
> +*/
> + input_enable_softrepeat(input_dev, 250, 125);
>
> if (av_cnt == 1) {
> e = proc_create("av7110_ir", S_IWUSR, NULL,
> &av7110_ir_proc_fops);
> --
> 2.13.6
>
--
Kees Cook
Pixel Security
ing autorepeat period to be whatever the hardware has.
>
> Signed-off-by: Dmitry Torokhov
Reviewed-by: Kees Cook
(with the Subject typo fixed)
Hans, since this depends on the input side not changing first, I think
it makes sense for Dmitry to carry this in the Input tree before the
Input timer upd
Eek, sorry, this uses timer_setup_on_stack() which is only in -next.
If you can Ack this, I can carry it in the timer tree.
Thanks!
-Kees
On Tue, Oct 24, 2017 at 5:22 PM, Kees Cook wrote:
> In preparation for unconditionally passing the struct timer_list pointer to
> all timer cal
: Arvind Yadav
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook
---
drivers/media/usb/s2255/s2255drv.c | 7 ---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/media/usb/s2255/s2255drv.c
b/drivers/media/usb/s2255/s2255drv.c
index b2f239c4ba42..7fee5766587a 100644
inux-media@vger.kernel.org
Signed-off-by: Kees Cook
---
drivers/media/radio/radio-cadet.c | 7 +++
drivers/media/radio/wl128x/fmdrv_common.c | 7 +++
2 files changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/media/radio/radio-cadet.c
b/drivers/media/radio/radio-cad
: "Antti Seppälä"
Cc: Heiner Kallweit
Cc: "David Härdeman"
Cc: Andi Shyti
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook
---
drivers/media/rc/ene_ir.c | 7 +++
drivers/media/rc/igorplugusb.c| 6 +++---
drivers/media/rc/img-i
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.
Cc: Mike Isely
Cc: Mauro Carvalho Chehab
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook
: Hans Verkuil
Cc: Arvind Yadav
Cc: Geliang Tang
Cc: Sean Young
Cc: Sakari Ailus
Cc: "Pali Rohár"
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook
---
drivers/media/pci/bt8xx/bttv-driver.c | 6 +++---
drivers/media/pci/bt8xx/bttv-input.c
On Thu, Oct 19, 2017 at 3:48 PM, Dmitry Torokhov
wrote:
> On Thu, Oct 19, 2017 at 03:45:38PM -0700, Kees Cook wrote:
>> On Thu, Oct 19, 2017 at 3:32 PM, Dmitry Torokhov
>> wrote:
>> > On Mon, Oct 16, 2017 at 04:14:43PM -0700, Kees Cook wrote:
>> >> In prepara
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.
Signed-off-by: Kees Cook
---
drivers/staging/media/atomisp/i2c/lm3554.c | 8 +++-
1 file changed, 3
On Thu, Oct 19, 2017 at 3:32 PM, Dmitry Torokhov
wrote:
> On Mon, Oct 16, 2017 at 04:14:43PM -0700, Kees Cook wrote:
>> In preparation for unconditionally passing the struct timer_list pointer to
>> all timer callbacks, switch to using the new timer_setup() and from_timer()
>&
On Tue, Oct 17, 2017 at 1:23 AM, Sakari Ailus wrote:
> On Mon, Oct 16, 2017 at 04:24:56PM -0700, Kees Cook wrote:
>> In preparation for unconditionally passing the struct timer_list pointer to
>> all timer callbacks, switch to using the new timer_setup() and from_timer()
>&
: linux-media@vger.kernel.org
Cc: de...@driverdev.osuosl.org
Signed-off-by: Kees Cook
---
drivers/staging/media/atomisp/pci/atomisp2/atomisp_cmd.c | 13 -
drivers/staging/media/atomisp/pci/atomisp2/atomisp_cmd.h | 6 +-
.../media/atomisp/pci/atomisp2/atomisp_compat_css20.c | 2
Signed-off-by: Kees Cook
Acked-by: Pali Rohár
---
drivers/input/input.c | 12 ++--
drivers/media/pci/ttpci/av7110.h| 1 -
drivers/media/pci/ttpci/av7110_ir.c | 16
include/linux/input.h | 2 ++
4 files changed, 16 insertions(+), 15 deletions
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.
Cc: Sean Young
Cc: Mauro Carvalho Chehab
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.
Cc: Mats Randgaard
Cc: Mauro Carvalho Chehab
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook
-media@vger.kernel.org
Signed-off-by: Kees Cook
---
drivers/media/pci/saa7134/saa7134-core.c | 6 +++---
drivers/media/pci/saa7134/saa7134-input.c | 9 -
drivers/media/pci/saa7134/saa7134-ts.c| 3 +--
drivers/media/pci/saa7134/saa7134-vbi.c | 3 +--
drivers/media/pci/saa7134/saa7134
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.
Cc: Hans Verkuil
Cc: Mauro Carvalho Chehab
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.
Cc: Mauro Carvalho Chehab
Cc: devendra sharma
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.
Cc: Mauro Carvalho Chehab
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook
---
drivers/media/i2c
his in the
future.
Cc: Hans Verkuil
Cc: Mauro Carvalho Chehab
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook
---
drivers/media/common/saa7146/saa7146_fops.c | 2 +-
drivers/media/common/saa7146/saa7146_vbi.c | 9 +
include/media/drv-intf/saa7146_vv.h | 1 +
3 files
: linux-media@vger.kernel.org
Cc: de...@driverdev.osuosl.org
Cc: Thomas Gleixner
Signed-off-by: Kees Cook
---
This requires commit 686fef928bba ("timer: Prepare to change timer
callback argument type") in v4.14-rc3, but should be otherwise
stand-alone.
---
drivers/staging/media/atomisp/pc
his in the
future.
Cc: Hans Verkuil
Cc: Mauro Carvalho Chehab
Cc: linux-media@vger.kernel.org
Cc: Thomas Gleixner
Signed-off-by: Kees Cook
---
This requires commit 686fef928bba ("timer: Prepare to change timer
callback argument type") in v4.14-rc3, but should be otherwise
stand-alone
-media@vger.kernel.org
Cc: Thomas Gleixner
Signed-off-by: Kees Cook
---
This requires commit 686fef928bba ("timer: Prepare to change timer
callback argument type") in v4.14-rc3, but should be otherwise
stand-alone.
---
drivers/media/pci/saa7134/saa7134-core.c | 6 +++---
drivers/media/p
-off-by: Kees Cook
---
This requires commit 686fef928bba ("timer: Prepare to change timer
callback argument type") in v4.14-rc3, but should be otherwise
stand-alone.
---
drivers/media/common/saa7146/saa7146_fops.c | 4 ++--
drivers/media/common/saa7146/saa7146_vbi.c | 3 +--
drivers/me
-by: Kees Cook
---
This requires commit 686fef928bba ("timer: Prepare to change timer
callback argument type") in v4.14-rc3, but should be otherwise
stand-alone.
---
drivers/media/rc/serial_ir.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/media/rc/ser
: Thomas Gleixner
Signed-off-by: Kees Cook
---
This requires commit 686fef928bba ("timer: Prepare to change timer
callback argument type") in v4.14-rc3, but should be otherwise
stand-alone.
---
drivers/input/input.c | 12 ++--
drivers/media/pci/ttpci/av7110
This converts to use setup_timer() to set callback and data, though it
doesn't look like this would have worked with timer checking enabled
since no init_timer() was ever called before.
Cc: Mats Randgaard
Cc: Mauro Carvalho Chehab
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees
This converts to use setup_timer() to set callback and data, though it
doesn't look like this would have worked with timer checking enabled
since no init_timer() was ever called before.
Cc: Mats Randgaard
Cc: Mauro Carvalho Chehab
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees
On Mon, Dec 19, 2016 at 11:56 AM, Andrey Utkin
wrote:
> On Fri, Dec 16, 2016 at 05:05:36PM -0800, Kees Cook wrote:
>> Prepare to mark sensitive kernel structures for randomization by making
>> sure they're using designated initializers. These were identified during
>>
Prepare to mark sensitive kernel structures for randomization by making
sure they're using designated initializers. These were identified during
allyesconfig builds of x86, arm, and arm64, with most initializer fixes
extracted from grsecurity.
Signed-off-by: Kees Cook
---
drivers/medi
Prepare to mark sensitive kernel structures for randomization by making
sure they're using designated initializers. These were identified during
allyesconfig builds of x86, arm, and arm64, with most initializer fixes
extracted from grsecurity.
Signed-off-by: Kees Cook
---
drivers/media/pla
> MODULE_PARM_DESC(debug, "Debug level (0-2)");
>
> struct tvp5150 {
> --
> 2.9.2
>
--
Kees Cook
Chrome OS & Brillo Security
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
[fixing Mauro's email...]
On Fri, Jul 15, 2016 at 11:52 AM, Kees Cook wrote:
> On Fri, Jul 15, 2016 at 8:40 AM, James Patrick-Evans wrote:
>> This patch addresses CVE-2016-5400, a local DOS vulnerability caused by a
>> memory leak in the airspy usb device driver. The vulner
ry leak is caused by the probe function of the airspy driver
> mishandeling errors and not freeing the corresponding control structures
> when an error occours registering the device to v4l2 core.
Thanks for getting this fixed!
> Signed-off-by: James Patrick-Evans
Reviewed-by: Kees Cook
Make sure that loaded modules are const char strings so we don't
load arbitrary modules in the future, nor allow for format string
leaks in the module request call.
Signed-off-by: Kees Cook
---
drivers/media/usb/dvb-usb-v2/anysee.c | 6 +++---
1 file changed, 3 insertions(+), 3 dele
Make sure that loaded modules are const char strings so we don't
load arbitrary modules in the future, nor allow for format string
leaks in the module request call.
Signed-off-by: Kees Cook
---
drivers/media/usb/dvb-usb-v2/af9035.c | 6 +++---
1 file changed, 3 insertions(+), 3 dele
x_send_attr(state, OUT_MSG_BRIDGE_APB_W, mb, 1 + len / 2,
> attribute);
> + dib9000_mbx_send_attr(state, OUT_MSG_BRIDGE_APB_W, mb, (3 + len) / 2,
> attribute);
> return dib9000_mbx_get_message_attr(state, IN_MSG_END_BRIDGE_APB_RW,
> mb, &s, attribute) == 1 ? 0 : -EINVAL;
> }
>
&
On Wed, Jun 18, 2014 at 6:41 PM, Heinrich Schuchardt wrote:
> On 19.06.2014 01:50, Kees Cook wrote:
>>
>> On Wed, Jun 18, 2014 at 3:02 PM, Heinrich Schuchardt
>> wrote:
>>>
>>> The current test to avoid out of bound access to mb[] is insufficient.
>&
assing len 3 means the second loop, with i==2 will access b[2]
and b[3], the latter is out of range.
-Kees
>
> dib9000_mbx_send_attr(state, OUT_MSG_BRIDGE_APB_W, mb, 1 + len / 2,
> attribute);
> --
> 2.0.0
>
--
Kees Cook
Chrome OS Security
--
To unsubscribe from t
rc_map_get() takes a single string literal for the module to load,
so make sure it cannot be used as a format string in the call to
request_module().
Signed-off-by: Kees Cook
---
On another security note, this raw request_module() call should have
some kind of prefix associated with it to make
Stop that, stop that! You're not going to do a song while I'm here.
Signed-off-by: Kees Cook
---
https://lkml.org/lkml/2013/12/4/786
http://www.youtube.com/watch?v=g3YiPC91QUk#t=62
---
Documentation/cgroups/resource_counter.txt |2 +-
Documentation/video4linux/si476x.txt
Make sure that a format string cannot accidentally leak into the printk
buffer.
Signed-off-by: Kees Cook
---
drivers/media/dvb-frontends/dib9000.c |2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-frontends/dib9000.c
b/drivers/media/dvb-frontends/dib9000
Moves use to after NULL-check.
Signed-off-by: Kees Cook
---
Sent before as part of https://patchwork.kernel.org/patch/138711/ but it
still hasn't been applied.
---
drivers/media/video/em28xx/em28xx-video.c |3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/dr
Fix potential crashes due to use-before-NULL situations.
Signed-off-by: Kees Cook
---
drivers/gpu/drm/drm_fb_helper.c |3 ++-
drivers/media/video/em28xx/em28xx-video.c |3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b
63 matches
Mail list logo
