Message ID | 4A15AF33.60100@gmail.com (mailing list archive) |
---|---|
State | Rejected, archived |
Headers | show |
Roel Kluin writes: > Do not go beyond ARRAY_SIZE of args.args > > Signed-off-by: Roel Kluin <roel.kluin@gmail.com> > --- > I'm quite sure the first is correct, but should maybe `args.nret' > and `nargs + args.nret' also be `>= ARRAY_SIZE(args.args)'? I don't think this change is needed, and it changes a user-visible API, so I'm nacking it unless you can convince me there's really a problem. If nargs == ARRAY_SIZE(args.args), then args.nret must be zero, so nothing will access *(args.rets). Paul.
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c index 1f8505c..c94ab76 100644 --- a/arch/powerpc/kernel/rtas.c +++ b/arch/powerpc/kernel/rtas.c @@ -779,7 +779,7 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs) return -EFAULT; nargs = args.nargs; - if (nargs > ARRAY_SIZE(args.args) + if (nargs >= ARRAY_SIZE(args.args) || args.nret > ARRAY_SIZE(args.args) || nargs + args.nret > ARRAY_SIZE(args.args)) return -EINVAL;
Do not go beyond ARRAY_SIZE of args.args Signed-off-by: Roel Kluin <roel.kluin@gmail.com> --- I'm quite sure the first is correct, but should maybe `args.nret' and `nargs + args.nret' also be `>= ARRAY_SIZE(args.args)'?