linux-kernel - [PATCH] clk: stm32: Fix out-by-one error path in the index lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1435485332-14951-1-git-send-email-daniel.thompson@linaro.org>
Date:	Sun, 28 Jun 2015 10:55:32 +0100
From:	Daniel Thompson <daniel.thompson@...aro.org>
To:	Mike Turquette <mturquette@...aro.org>,
	Stephen Boyd <sboyd@...eaurora.org>
Cc:	Daniel Thompson <daniel.thompson@...aro.org>,
	Maxime Coquelin <mcoquelin.stm32@...il.com>,
	linux-clk@...r.kernel.org, linux-kernel@...r.kernel.org,
	patches@...aro.org, linaro-kernel@...ts.linaro.org
Subject: [PATCH] clk: stm32: Fix out-by-one error path in the index lookup

If stm32f4_rcc_lookup() is called with primary == 0 and secondary == 192
then it will read beyond the end of the table array due to an out-by-one
error in the range check.

In addition to the fixing the inequality we also modify the r.h.s. to
make it even more explicit that we are comparing against the size of
table in bits.

Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
Signed-off-by: Daniel Thompson <daniel.thompson@...aro.org>
---
 drivers/clk/clk-stm32f4.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c
index c825bbd..148c151 100644
--- a/drivers/clk/clk-stm32f4.c
+++ b/drivers/clk/clk-stm32f4.c
@@ -268,7 +268,7 @@ static int stm32f4_rcc_lookup_clk_idx(u8 primary, u8 secondary)
 	memcpy(table, stm32f42xx_gate_map, sizeof(table));

 	/* only bits set in table can be used as indices */
-	if (WARN_ON(secondary > 8 * sizeof(table) ||
+	if (WARN_ON(secondary >= BITS_PER_BYTE * sizeof(table) ||
 		    0 == (table[BIT_ULL_WORD(secondary)] &
 			  BIT_ULL_MASK(secondary))))
 		return -EINVAL;
--
2.4.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/