]> git.baikalelectronics.ru Git - kernel.git/commit
ACPI: APEI / ERST: Fix missing error handling in erst_reader()
authorTakashi Iwai <tiwai@suse.de>
Thu, 14 Dec 2017 12:31:16 +0000 (13:31 +0100)
committerRafael J. Wysocki <rafael.j.wysocki@intel.com>
Mon, 18 Dec 2017 11:12:08 +0000 (12:12 +0100)
commitb5c6ae24c23e9cc4bca2c7f1fd5294d501e70490
treef911ce192d8e59d8f979a1dd56f7f70b1d8a237d
parent6d26e52fc39dd1b277640428ccc4ab1abd836cd8
ACPI: APEI / ERST: Fix missing error handling in erst_reader()

The commit 5ba90dbfb334 ("pstore: pass allocated memory region back to
caller") changed the check of the return value from erst_read() in
erst_reader() in the following way:

        if (len == -ENOENT)
                goto skip;
-       else if (len < 0) {
-               rc = -1;
+       else if (len < sizeof(*rcd)) {
+               rc = -EIO;
                goto out;

This introduced another bug: since the comparison with sizeof() is
cast to unsigned, a negative len value doesn't hit any longer.
As a result, when an error is returned from erst_read(), the code
falls through, and it may eventually lead to some weird thing like
memory corruption.

This patch adds the negative error value check more explicitly for
addressing the issue.

Fixes: 5ba90dbfb334 (pstore: pass allocated memory region back to caller)
Cc: All applicable <stable@vger.kernel.org>
Tested-by: Jerry Tang <jtang@suse.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
drivers/acpi/apei/erst.c