RE: [patch] isdn: fix a wrapping bug in isdn_ppp_ioctl()

-----Original Message-----
From: netdev-owner@vger.kernel.org [mailto:netdev-owner@vger.kernel.org] On Behalf Of Joe Perches
Sent: 10 October 2012 15:42
To: Andreas Schwab
Cc: Dan Carpenter; Karsten Keil; David S. Miller; Masanari Iida; netdev@vger.kernel.org; kernel-
janitors@vger.kernel.org
Subject: Re: [patch] isdn: fix a wrapping bug in isdn_ppp_ioctl()

On Wed, 2012-10-10 at 15:58 +0200, Andreas Schwab wrote:

quoted

Sorry, I was misremembering the history of the bit ops.  There has
historically been issues with varying bit order, but noadays set_bit is
always defined consistently with C shifts.

No worries.  Anyway, the change was suggested to aid
reader comprehension.  If it doesn't (and it seems not)
then it's not worth it.

Anyway, there is still the open question of an overrun/info
leak.

quoted

quoted

-           if ((r = set_arg(argp, protos, 8 * sizeof(long))))

set_arg's 2nd arg is bytes not bits.

Seems to me the code is expecting 256 bits of data, not any multiple of int,
long or anything else.

	David