renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-23 20:53:53 +08:00
Code

powerpc/powernv: Fix the overflow of OPAL message notifiers head array

Browse Source 
Fixes the condition check of incoming message type which can
otherwise shoot beyond the message notifiers head array.

Signed-off-by: Neelesh Gupta <neelegup@linux.vnet.ibm.com>
Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Reviewed-by: Anshuman Khandual <khandual@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
This commit is contained in:
Neelesh Gupta 2015-02-11 11:57:06 +05:30 committed by Benjamin Herrenschmidt
parent 111fbc68fd
commit 792f96e9a7
1 changed files with 4 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
arch/powerpc/platforms/powernv/opal.c
View File

@ -308,16 +308,12 @@ void opal_notifier_disable(void)
int opal_message_notifier_register(enum OpalMessageType msg_type,
struct notifier_block *nb)
{
if (!nb) {
pr_warning("%s: Invalid argument (%p)\n",
__func__, nb);
return -EINVAL;
}
if (msg_type > OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Invalid message type argument (%d)\n",
if (!nb || msg_type >= OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Invalid arguments, msg_type:%d\n",
__func__, msg_type);
return -EINVAL;
}
return atomic_notifier_chain_register(
&opal_msg_notifier_head[msg_type], nb);
}
@ -354,7 +350,7 @@ static void opal_handle_message(void)
type = be32_to_cpu(msg.msg_type);
/* Sanity check */
if (type > OPAL_MSG_TYPE_MAX) {
if (type >= OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Unknown message type: %u\n", __func__, type);
return;
}