* [PATCH][next] mailbox: PCC: check for negative count for parse failure checking
@ 2018-05-30 17:14 Colin King
2018-05-30 17:59 ` Al Stone
2018-05-30 19:21 ` Dan Carpenter
0 siblings, 2 replies; 5+ messages in thread
From: Colin King @ 2018-05-30 17:14 UTC (permalink / raw)
To: Jassi Brar, Al Stone; +Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
The function acpi_table_parse_enties_array can potentially return a
negative value if parsing fails. Currently the check on the return
is not checking for errors, so fix this by adding a -ve check too.
Detected by CoverityScan, CID#1469477 ("Improper use of negative value")
Fixes: 8f8027c5f935 ("mailbox: PCC: erroneous error message when parsing ACPI PCCT")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/mailbox/pcc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index fc3c237daef2..87d67922020d 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -461,7 +461,7 @@ static int __init acpi_pcc_probe(void)
count = acpi_table_parse_entries_array(ACPI_SIG_PCCT,
sizeof(struct acpi_table_pcct), proc,
ACPI_PCCT_TYPE_RESERVED, MAX_PCC_SUBSPACES);
- if (count == 0 || count > MAX_PCC_SUBSPACES) {
+ if (count <= 0 || count > MAX_PCC_SUBSPACES) {
pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
return -EINVAL;
}
--
2.17.0
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH][next] mailbox: PCC: check for negative count for parse failure checking
2018-05-30 17:14 [PATCH][next] mailbox: PCC: check for negative count for parse failure checking Colin King
@ 2018-05-30 17:59 ` Al Stone
2018-05-30 18:24 ` Colin Ian King
2018-05-30 19:21 ` Dan Carpenter
1 sibling, 1 reply; 5+ messages in thread
From: Al Stone @ 2018-05-30 17:59 UTC (permalink / raw)
To: Colin King, Jassi Brar; +Cc: kernel-janitors, linux-kernel
On 05/30/2018 11:14 AM, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The function acpi_table_parse_enties_array can potentially return a
> negative value if parsing fails. Currently the check on the return
> is not checking for errors, so fix this by adding a -ve check too.
>
> Detected by CoverityScan, CID#1469477 ("Improper use of negative value")
>
> Fixes: 8f8027c5f935 ("mailbox: PCC: erroneous error message when parsing ACPI PCCT")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
> drivers/mailbox/pcc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
> index fc3c237daef2..87d67922020d 100644
> --- a/drivers/mailbox/pcc.c
> +++ b/drivers/mailbox/pcc.c
> @@ -461,7 +461,7 @@ static int __init acpi_pcc_probe(void)
> count = acpi_table_parse_entries_array(ACPI_SIG_PCCT,
> sizeof(struct acpi_table_pcct), proc,
> ACPI_PCCT_TYPE_RESERVED, MAX_PCC_SUBSPACES);
> - if (count == 0 || count > MAX_PCC_SUBSPACES) {
> + if (count <= 0 || count > MAX_PCC_SUBSPACES) {
> pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
> return -EINVAL;
> }
>
Yup, nice catch. A little paranoid, but we like that in a kernel :). Thanks.
Reviewed-by: Al Stone <ahs3@redhat.com>
--
ciao,
al
-----------------------------------
Al Stone
Software Engineer
Red Hat, Inc.
ahs3@redhat.com
-----------------------------------
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH][next] mailbox: PCC: check for negative count for parse failure checking
2018-05-30 17:59 ` Al Stone
@ 2018-05-30 18:24 ` Colin Ian King
2018-05-30 18:49 ` Al Stone
0 siblings, 1 reply; 5+ messages in thread
From: Colin Ian King @ 2018-05-30 18:24 UTC (permalink / raw)
To: ahs3, Jassi Brar; +Cc: kernel-janitors, linux-kernel
On 30/05/18 18:59, Al Stone wrote:
> On 05/30/2018 11:14 AM, Colin King wrote:
>> From: Colin Ian King <colin.king@canonical.com>
>>
>> The function acpi_table_parse_enties_array can potentially return a
>> negative value if parsing fails. Currently the check on the return
>> is not checking for errors, so fix this by adding a -ve check too.
>>
>> Detected by CoverityScan, CID#1469477 ("Improper use of negative value")
>>
>> Fixes: 8f8027c5f935 ("mailbox: PCC: erroneous error message when parsing ACPI PCCT")
>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>> ---
>> drivers/mailbox/pcc.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
>> index fc3c237daef2..87d67922020d 100644
>> --- a/drivers/mailbox/pcc.c
>> +++ b/drivers/mailbox/pcc.c
>> @@ -461,7 +461,7 @@ static int __init acpi_pcc_probe(void)
>> count = acpi_table_parse_entries_array(ACPI_SIG_PCCT,
>> sizeof(struct acpi_table_pcct), proc,
>> ACPI_PCCT_TYPE_RESERVED, MAX_PCC_SUBSPACES);
>> - if (count == 0 || count > MAX_PCC_SUBSPACES) {
>> + if (count <= 0 || count > MAX_PCC_SUBSPACES) {
>> pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
>> return -EINVAL;
>> }
>>
>
> Yup, nice catch. A little paranoid, but we like that in a kernel :). Thanks.
If it can go wrong, it will go wrong, especially with firmware :-)
>
> Reviewed-by: Al Stone <ahs3@redhat.com>
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH][next] mailbox: PCC: check for negative count for parse failure checking
2018-05-30 18:24 ` Colin Ian King
@ 2018-05-30 18:49 ` Al Stone
0 siblings, 0 replies; 5+ messages in thread
From: Al Stone @ 2018-05-30 18:49 UTC (permalink / raw)
To: Colin Ian King, Jassi Brar; +Cc: kernel-janitors, linux-kernel
On 05/30/2018 12:24 PM, Colin Ian King wrote:
> On 30/05/18 18:59, Al Stone wrote:
>> On 05/30/2018 11:14 AM, Colin King wrote:
>>> From: Colin Ian King <colin.king@canonical.com>
>>>
>>> The function acpi_table_parse_enties_array can potentially return a
>>> negative value if parsing fails. Currently the check on the return
>>> is not checking for errors, so fix this by adding a -ve check too.
>>>
>>> Detected by CoverityScan, CID#1469477 ("Improper use of negative value")
>>>
>>> Fixes: 8f8027c5f935 ("mailbox: PCC: erroneous error message when parsing ACPI PCCT")
>>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>>> ---
>>> drivers/mailbox/pcc.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
>>> index fc3c237daef2..87d67922020d 100644
>>> --- a/drivers/mailbox/pcc.c
>>> +++ b/drivers/mailbox/pcc.c
>>> @@ -461,7 +461,7 @@ static int __init acpi_pcc_probe(void)
>>> count = acpi_table_parse_entries_array(ACPI_SIG_PCCT,
>>> sizeof(struct acpi_table_pcct), proc,
>>> ACPI_PCCT_TYPE_RESERVED, MAX_PCC_SUBSPACES);
>>> - if (count == 0 || count > MAX_PCC_SUBSPACES) {
>>> + if (count <= 0 || count > MAX_PCC_SUBSPACES) {
>>> pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
>>> return -EINVAL;
>>> }
>>>
>>
>> Yup, nice catch. A little paranoid, but we like that in a kernel :). Thanks.
>
> If it can go wrong, it will go wrong, especially with firmware :-)
Amen to that! You are preachin' to the choir, brother ...
>>
>> Reviewed-by: Al Stone <ahs3@redhat.com>
>>
>
--
ciao,
al
-----------------------------------
Al Stone
Software Engineer
Red Hat, Inc.
ahs3@redhat.com
-----------------------------------
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH][next] mailbox: PCC: check for negative count for parse failure checking
2018-05-30 17:14 [PATCH][next] mailbox: PCC: check for negative count for parse failure checking Colin King
2018-05-30 17:59 ` Al Stone
@ 2018-05-30 19:21 ` Dan Carpenter
1 sibling, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2018-05-30 19:21 UTC (permalink / raw)
To: Colin King; +Cc: Jassi Brar, Al Stone, kernel-janitors, linux-kernel
On Wed, May 30, 2018 at 06:14:29PM +0100, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The function acpi_table_parse_enties_array can potentially return a
> negative value if parsing fails. Currently the check on the return
> is not checking for errors, so fix this by adding a -ve check too.
>
The impact is that kmallocs would immediately fail and give you a big
stack trace.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-05-30 19:21 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-30 17:14 [PATCH][next] mailbox: PCC: check for negative count for parse failure checking Colin King
2018-05-30 17:59 ` Al Stone
2018-05-30 18:24 ` Colin Ian King
2018-05-30 18:49 ` Al Stone
2018-05-30 19:21 ` Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®