]> git.baikalelectronics.ru Git - kernel.git/commit
powerpc: Add array bounds checking to crash_shutdown_handlers
authorSuraj Jitindar Singh <sjitindarsingh@gmail.com>
Wed, 11 May 2016 00:57:32 +0000 (10:57 +1000)
committerMichael Ellerman <mpe@ellerman.id.au>
Thu, 16 Jun 2016 06:05:47 +0000 (16:05 +1000)
commit23d8f8c66f7e763d6ce28c4d23ae5d007c861c2d
tree4758fb505baba109df90e6f75247c429e30a8940
parent255dd9b360518285d6baaf44d8ca6554d13796ee
powerpc: Add array bounds checking to crash_shutdown_handlers

The array crash_shutdown_handles is an array of size CRASH_HANDLER_MAX+1
containing up to CRASH_HANDLER_MAX shutdown_handlers. It is assumed to
be NULL terminated, which it is under normal circumstances. Array
accesses in the functions crash_shutdown_unregister() and
default_machine_crash_shutdown() rely on this NULL termination property
when traversing this list and don't protect again out of bounds accesses.
If the NULL terminator were somehow overwritten these functions could
potentially access out of the bounds of the array.

Shrink the array to size CRASH_HANDLER_MAX and implement explicit array
bounds checking when accessing the elements of the
crash_shutdown_handles[] array in crash_shutdown_unregister() and
default_machine_crash_shutdown().

Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
arch/powerpc/kernel/crash.c