提交 8b44f00f 编写于 作者: C Colin Ian King 提交者: Ingo Molnar

x86/RAS/mce_amd_inj: Fix signed wrap around when decrementing index 'i'

Change predecrement compare to post decrement compare to avoid an
unsigned integer wrap-around comparisomn when decrementing in the while
loop.

For example, if the debugfs_create_file() fails when 'i' is zero, the
current situation will predecrement 'i' in the while loop, wrapping 'i' to
the maximum signed integer and cause multiple out of bounds reads on
dfs_fls[i].d as the loop interates to zero.

Also, as Borislav Petkov suggested, return -ENODEV rather than -ENOMEM
on the error condition.
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NBorislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Yazen Ghannam <Yazen.Ghannam@amd.com>
Link: http://lkml.kernel.org/r/20160926083152.30848-2-bp@alien8.deSigned-off-by: NIngo Molnar <mingo@kernel.org>
上级 6fae257f
...@@ -464,13 +464,13 @@ static int __init init_mce_inject(void) ...@@ -464,13 +464,13 @@ static int __init init_mce_inject(void)
return 0; return 0;
err_dfs_add: err_dfs_add:
while (--i >= 0) while (i-- > 0)
debugfs_remove(dfs_fls[i].d); debugfs_remove(dfs_fls[i].d);
debugfs_remove(dfs_inj); debugfs_remove(dfs_inj);
dfs_inj = NULL; dfs_inj = NULL;
return -ENOMEM; return -ENODEV;
} }
static void __exit exit_mce_inject(void) static void __exit exit_mce_inject(void)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册