lkml.org 
[lkml]   [2020]   [May]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 64/90] staging: gasket: Check the return value of gasket_get_bar_index()
    Date
    From: Oscar Carter <oscar.carter@gmx.com>

    commit 769acc3656d93aaacada814939743361d284fd87 upstream.

    Check the return value of gasket_get_bar_index function as it can return
    a negative one (-EINVAL). If this happens, a negative index is used in
    the "gasket_dev->bar_data" array.

    Addresses-Coverity-ID: 1438542 ("Negative array index read")
    Fixes: 9a69f5087ccc2 ("drivers/staging: Gasket driver framework + Apex driver")
    Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
    Cc: stable <stable@vger.kernel.org>
    Reviewed-by: Richard Yeh <rcy@google.com>
    Link: https://lore.kernel.org/r/20200501155118.13380-1-oscar.carter@gmx.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/staging/gasket/gasket_core.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/drivers/staging/gasket/gasket_core.c
    +++ b/drivers/staging/gasket/gasket_core.c
    @@ -926,6 +926,10 @@ do_map_region(const struct gasket_dev *g
    gasket_get_bar_index(gasket_dev,
    (vma->vm_pgoff << PAGE_SHIFT) +
    driver_desc->legacy_mmap_address_offset);
    +
    + if (bar_index < 0)
    + return DO_MAP_REGION_INVALID;
    +
    phys_base = gasket_dev->bar_data[bar_index].phys_base + phys_offset;
    while (mapped_bytes < map_length) {
    /*

    \
     
     \ /
      Last update: 2020-05-13 11:50    [W:4.136 / U:0.992 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site