From: Dan Carpenter <dan.carpenter@oracle.com>
To: kernel-janitors@vger.kernel.org
Subject: [PATCH] ipmi_si: Potential array underflow in hotmod_handler()
Date: Fri, 22 Feb 2019 19:55:30 +0000 [thread overview]
Message-ID: <20190222195530.GA306@kadam> (raw)
The "ival" variable needs to signed so that we don't read before the
start of the str[] array. This would only happen the user passed in a
module parameter that was just comprised of space characters.
Fixes: e80444ae4fc3 ("ipmi_si: Switch hotmod to use a platform device")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/char/ipmi/ipmi_si_hotmod.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/char/ipmi/ipmi_si_hotmod.c b/drivers/char/ipmi/ipmi_si_hotmod.c
index 1433055a9705..03140f6cdf6f 100644
--- a/drivers/char/ipmi/ipmi_si_hotmod.c
+++ b/drivers/char/ipmi/ipmi_si_hotmod.c
@@ -187,7 +187,8 @@ static int hotmod_handler(const char *val, const struct kernel_param *kp)
char *str = kstrdup(val, GFP_KERNEL), *curr, *next;
int rv;
struct ipmi_plat_data h;
- unsigned int len, ival;
+ unsigned int len;
+ int ival;
if (!str)
return -ENOMEM;
--
2.17.1
next reply other threads:[~2019-02-22 19:55 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-22 19:55 Dan Carpenter [this message]
2019-02-22 21:00 ` [PATCH] ipmi_si: Potential array underflow in hotmod_handler()y Corey Minyard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190222195530.GA306@kadam \
--to=dan.carpenter@oracle.com \
--cc=kernel-janitors@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.