lkml.org 
[lkml]   [2024]   [May]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[tip: timers/urgent] timers/migration: Prevent out of bounds access on failure
The following commit has been merged into the timers/urgent branch of tip:

Commit-ID: d7ad05c86e2191bd66e5b62fca8da53c4a53484f
Gitweb: https://git.kernel.org/tip/d7ad05c86e2191bd66e5b62fca8da53c4a53484f
Author: Levi Yun <ppbuk5246@gmail.com>
AuthorDate: Mon, 06 May 2024 05:10:59 +01:00
Committer: Thomas Gleixner <tglx@linutronix.de>
CommitterDate: Wed, 08 May 2024 11:19:43 +02:00

timers/migration: Prevent out of bounds access on failure

When tmigr_setup_groups() fails the level 0 group allocation, then the
cleanup derefences index -1 of the local stack array.

Prevent this by checking the loop condition first.

Fixes: 7ee988770326 ("timers: Implement the hierarchical pull model")
Signed-off-by: Levi Yun <ppbuk5246@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Anna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/r/20240506041059.86877-1-ppbuk5246@gmail.com
---
kernel/time/timer_migration.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/time/timer_migration.c b/kernel/time/timer_migration.c
index ccba875..8441311 100644
--- a/kernel/time/timer_migration.c
+++ b/kernel/time/timer_migration.c
@@ -1596,7 +1596,7 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node)

} while (i < tmigr_hierarchy_levels);

- do {
+ while (i > 0) {
group = stack[--i];

if (err < 0) {
@@ -1645,7 +1645,7 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node)
tmigr_connect_child_parent(child, group);
}
}
- } while (i > 0);
+ }

kfree(stack);

\
 
 \ /
  Last update: 2024-05-08 11:45    [W:0.115 / U:0.336 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site