linux-kernel - [PATCH 15/16] coresight: etm4x: Fix mis-usage of nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200916191737.4001561-16-mathieu.poirier@linaro.org>
Date:   Wed, 16 Sep 2020 13:17:36 -0600
From:   Mathieu Poirier <mathieu.poirier@...aro.org>
To:     gregkh@...uxfoundation.org
Cc:     linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: [PATCH 15/16] coresight: etm4x: Fix mis-usage of nr_resource in sysfs interface

From: Jonathan Zhou <jonathan.zhouwen@...wei.com>

The member @nr_resource represents how many resource selector pairs,
and the pair 0 is always implemented and reserved.
So let's multiply by 2 when resetting the selector configuration.
And also update the validation of the input @idx.

Cc: Mathieu Poirier <mathieu.poirier@...aro.org>
Cc: Suzuki K Poulose <suzuki.poulose@....com>
Cc: Mike Leach <mike.leach@...aro.org>
Cc: Shaokun Zhang <zhangshaokun@...ilicon.com>
Cc: lizixian@...ilicon.com
Cc: stable@...r.kernel.org
Signed-off-by: Jonathan Zhou <jonathan.zhouwen@...wei.com>
[Fixed typographical error in changelog, added stable]
Signed-off-by: Mathieu Poirier <mathieu.poirier@...aro.org>
---
 drivers/hwtracing/coresight/coresight-etm4x-sysfs.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
index a588cd6de01c..989ce7b8ade7 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
@@ -236,7 +236,7 @@ static ssize_t reset_store(struct device *dev,
 	}
 
 	config->res_idx = 0x0;
-	for (i = 0; i < drvdata->nr_resource; i++)
+	for (i = 2; i < 2 * drvdata->nr_resource; i++)
 		config->res_ctrl[i] = 0x0;
 
 	config->ss_idx = 0x0;
@@ -1663,8 +1663,11 @@ static ssize_t res_idx_store(struct device *dev,
 
 	if (kstrtoul(buf, 16, &val))
 		return -EINVAL;
-	/* Resource selector pair 0 is always implemented and reserved */
-	if ((val == 0) || (val >= drvdata->nr_resource))
+	/*
+	 * Resource selector pair 0 is always implemented and reserved,
+	 * namely an idx with 0 and 1 is illegal.
+	 */
+	if ((val < 2) || (val >= 2 * drvdata->nr_resource))
 		return -EINVAL;
 
 	/*
-- 
2.25.1