From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1423285AbcIZQdy (ORCPT ); Mon, 26 Sep 2016 12:33:54 -0400 Received: from terminus.zytor.com ([198.137.202.10]:48448 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1422915AbcIZQdu (ORCPT ); Mon, 26 Sep 2016 12:33:50 -0400 Date: Mon, 26 Sep 2016 09:31:37 -0700 From: tip-bot for Colin Ian King Message-ID: Cc: Yazen.Ghannam@amd.com, bp@suse.de, torvalds@linux-foundation.org, hpa@zytor.com, colin.king@canonical.com, peterz@infradead.org, linux-kernel@vger.kernel.org, tglx@linutronix.de, mingo@kernel.org Reply-To: linux-kernel@vger.kernel.org, peterz@infradead.org, colin.king@canonical.com, hpa@zytor.com, tglx@linutronix.de, mingo@kernel.org, bp@suse.de, Yazen.Ghannam@amd.com, torvalds@linux-foundation.org In-Reply-To: <20160926083152.30848-2-bp@alien8.de> References: <20160926083152.30848-2-bp@alien8.de> To: linux-tip-commits@vger.kernel.org Subject: [tip:ras/core] x86/RAS/mce_amd_inj: Fix signed wrap around when decrementing index 'i' Git-Commit-ID: 8b44f00f8c952ab6eb658090383571b2ec7d253f X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 8b44f00f8c952ab6eb658090383571b2ec7d253f Gitweb: http://git.kernel.org/tip/8b44f00f8c952ab6eb658090383571b2ec7d253f Author: Colin Ian King AuthorDate: Mon, 26 Sep 2016 10:31:51 +0200 Committer: Ingo Molnar CommitDate: Mon, 26 Sep 2016 11:13:17 +0200 x86/RAS/mce_amd_inj: Fix signed wrap around when decrementing index 'i' Change predecrement compare to post decrement compare to avoid an unsigned integer wrap-around comparisomn when decrementing in the while loop. For example, if the debugfs_create_file() fails when 'i' is zero, the current situation will predecrement 'i' in the while loop, wrapping 'i' to the maximum signed integer and cause multiple out of bounds reads on dfs_fls[i].d as the loop interates to zero. Also, as Borislav Petkov suggested, return -ENODEV rather than -ENOMEM on the error condition. Signed-off-by: Colin Ian King Signed-off-by: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yazen Ghannam Link: http://lkml.kernel.org/r/20160926083152.30848-2-bp@alien8.de Signed-off-by: Ingo Molnar --- arch/x86/ras/mce_amd_inj.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/ras/mce_amd_inj.c b/arch/x86/ras/mce_amd_inj.c index cd318d9..20b227f 100644 --- a/arch/x86/ras/mce_amd_inj.c +++ b/arch/x86/ras/mce_amd_inj.c @@ -464,13 +464,13 @@ static int __init init_mce_inject(void) return 0; err_dfs_add: - while (--i >= 0) + while (i-- > 0) debugfs_remove(dfs_fls[i].d); debugfs_remove(dfs_inj); dfs_inj = NULL; - return -ENOMEM; + return -ENODEV; } static void __exit exit_mce_inject(void)