linux-kernel - Re: [PATCH][next] mailbox: PCC: check for negative count for parse failure checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0d780988-0e59-a3b7-a7c1-9e3f0d227412@redhat.com>
Date:   Wed, 30 May 2018 11:59:45 -0600
From:   Al Stone <ahs3@...hat.com>
To:     Colin King <colin.king@...onical.com>,
        Jassi Brar <jassisinghbrar@...il.com>
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH][next] mailbox: PCC: check for negative count for parse
 failure checking

On 05/30/2018 11:14 AM, Colin King wrote:
> From: Colin Ian King <colin.king@...onical.com>
> 
> The function acpi_table_parse_enties_array can potentially return a
> negative value if parsing fails. Currently the check on the return
> is not checking for errors, so fix this by adding a -ve check too.
> 
> Detected by CoverityScan, CID#1469477 ("Improper use of negative value")
> 
> Fixes: 8f8027c5f935 ("mailbox: PCC: erroneous error message when parsing ACPI PCCT")
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>  drivers/mailbox/pcc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
> index fc3c237daef2..87d67922020d 100644
> --- a/drivers/mailbox/pcc.c
> +++ b/drivers/mailbox/pcc.c
> @@ -461,7 +461,7 @@ static int __init acpi_pcc_probe(void)
>  	count = acpi_table_parse_entries_array(ACPI_SIG_PCCT,
>  			sizeof(struct acpi_table_pcct), proc,
>  			ACPI_PCCT_TYPE_RESERVED, MAX_PCC_SUBSPACES);
> -	if (count == 0 || count > MAX_PCC_SUBSPACES) {
> +	if (count <= 0 || count > MAX_PCC_SUBSPACES) {
>  		pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
>  		return -EINVAL;
>  	}
> 

Yup, nice catch.  A little paranoid, but we like that in a kernel :).  Thanks.

Reviewed-by: Al Stone <ahs3@...hat.com>

-- 
ciao,
al
-----------------------------------
Al Stone
Software Engineer
Red Hat, Inc.
ahs3@...hat.com
-----------------------------------