summaryrefslogtreecommitdiff
path: root/arch/x86/ras
diff options
context:
space:
mode:
authorColin Ian King <colin.king@canonical.com>2016-09-26 11:31:51 +0300
committerIngo Molnar <mingo@kernel.org>2016-09-26 12:13:17 +0300
commit8b44f00f8c952ab6eb658090383571b2ec7d253f (patch)
tree572c6fa32b6e3b0b49735b874e2c905320d3a0ba /arch/x86/ras
parent6fae257f0b294d7abe7adfb08277bfd5472ed717 (diff)
downloadlinux-8b44f00f8c952ab6eb658090383571b2ec7d253f.tar.xz
x86/RAS/mce_amd_inj: Fix signed wrap around when decrementing index 'i'
Change predecrement compare to post decrement compare to avoid an unsigned integer wrap-around comparisomn when decrementing in the while loop. For example, if the debugfs_create_file() fails when 'i' is zero, the current situation will predecrement 'i' in the while loop, wrapping 'i' to the maximum signed integer and cause multiple out of bounds reads on dfs_fls[i].d as the loop interates to zero. Also, as Borislav Petkov suggested, return -ENODEV rather than -ENOMEM on the error condition. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Borislav Petkov <bp@suse.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Yazen Ghannam <Yazen.Ghannam@amd.com> Link: http://lkml.kernel.org/r/20160926083152.30848-2-bp@alien8.de Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'arch/x86/ras')
-rw-r--r--arch/x86/ras/mce_amd_inj.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/x86/ras/mce_amd_inj.c b/arch/x86/ras/mce_amd_inj.c
index cd318d93099e..20b227f63407 100644
--- a/arch/x86/ras/mce_amd_inj.c
+++ b/arch/x86/ras/mce_amd_inj.c
@@ -464,13 +464,13 @@ static int __init init_mce_inject(void)
return 0;
err_dfs_add:
- while (--i >= 0)
+ while (i-- > 0)
debugfs_remove(dfs_fls[i].d);
debugfs_remove(dfs_inj);
dfs_inj = NULL;
- return -ENOMEM;
+ return -ENODEV;
}
static void __exit exit_mce_inject(void)