[ Sasha's backport helper bot ]
Hi,
✅ All tests passed successfully. No issues detected. No action required from the submitter.
The upstream commit SHA1 provided is correct: 08ae4b20f5e82101d77326ecab9089e110f224cc
Status in newer kernel trees: 6.15.y | Not found 6.12.y | Not found 6.6.y | Not found 6.1.y | Not found 5.15.y | Not found
Note: The patch differs from the upstream commit: --- 1: 08ae4b20f5e8 ! 1: 973ce1afed22 comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large @@ Metadata ## Commit message ## comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
+ [ Upstream commit 08ae4b20f5e82101d77326ecab9089e110f224cc ] + The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length from the `n_insns` member of the `struct comedi_insnlist` supplied by the user. @@ Commit message Link: https://lore.kernel.org/r/20250704120405.83028-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
- ## drivers/comedi/comedi_fops.c ## -@@ drivers/comedi/comedi_fops.c: static int do_insnlist_ioctl(struct comedi_device *dev, + ## drivers/staging/comedi/comedi_fops.c ## +@@ drivers/staging/comedi/comedi_fops.c: static int do_insnlist_ioctl(struct comedi_device *dev, return i; }
@@ drivers/comedi/comedi_fops.c: static int do_insnlist_ioctl(struct comedi_device /* * COMEDI_INSN ioctl * synchronous instruction -@@ drivers/comedi/comedi_fops.c: static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd, +@@ drivers/staging/comedi/comedi_fops.c: static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd, rc = -EFAULT; break; } @@ drivers/comedi/comedi_fops.c: static long comedi_unlocked_ioctl(struct file *fil insns = kcalloc(insnlist.n_insns, sizeof(*insns), GFP_KERNEL); if (!insns) { rc = -ENOMEM; -@@ drivers/comedi/comedi_fops.c: static int compat_insnlist(struct file *file, unsigned long arg) +@@ drivers/staging/comedi/comedi_fops.c: static int compat_insnlist(struct file *file, unsigned long arg) if (copy_from_user(&insnlist32, compat_ptr(arg), sizeof(insnlist32))) return -EFAULT;
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | origin/linux-5.10.y | Success | Success |