[Vivid][SRU][PATCH] powerpc/powernv: Fix the overflow of OPAL message notifiers head array
Chris J Arges
chris.j.arges at canonical.com
Fri Aug 21 00:10:38 UTC 2015
From: Neelesh Gupta <neelegup at linux.vnet.ibm.com>
BugLink: http://bugs.launchpad.net/bugs/1487085
Fixes the condition check of incoming message type which can
otherwise shoot beyond the message notifiers head array.
Signed-off-by: Neelesh Gupta <neelegup at linux.vnet.ibm.com>
Reviewed-by: Vasant Hegde <hegdevasant at linux.vnet.ibm.com>
Reviewed-by: Anshuman Khandual <khandual at linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>
(backported from commit 792f96e9a769b799a2944e9369e4ea1e467135b2)
Some of this commit was merged into 9b42c07.
This backport covers the remaining parts.
Signed-off-by: Chris J Arges <chris.j.arges at canonical.com>
---
arch/powerpc/platforms/powernv/opal.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index 8375bf3..3f34413 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -313,6 +313,7 @@ int opal_message_notifier_register(enum opal_msg_type msg_type,
__func__, msg_type);
return -EINVAL;
}
+
return atomic_notifier_chain_register(
&opal_msg_notifier_head[msg_type], nb);
}
@@ -358,7 +359,7 @@ static void opal_handle_message(void)
type = be32_to_cpu(msg.msg_type);
/* Sanity check */
- if (type > OPAL_MSG_TYPE_MAX) {
+ if (type >= OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Unknown message type: %u\n", __func__, type);
return;
}
--
2.5.0
More information about the kernel-team
mailing list