* [PATCH] ACPI: NFIT: prevent underflow in acpi_nfit_ctl(
@ 2023-01-19 14:47 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2023-01-19 14:47 UTC (permalink / raw)
To: Dan Williams
Cc: Vishal Verma, Dave Jiang, Ira Weiny, Rafael J. Wysocki, Len Brown,
nvdimm, linux-acpi, kernel-janitors, cip-dev, Harshit Mogalapalli
The concern here would be that "family" is negative and we pass a
negative value to test_bit() resulting in an out of bounds read
and potentially a crash.
This patch is based on static analysis and not on testing.
Fixes: 9a7e3d7f0568 ("ACPI: NFIT: Fix input validation of bus-family")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
Another idea would be that we could change test_bit() to not accept
bits higher than INT_MAX.
drivers/acpi/nfit/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index f1cc5ec6a3b6..da0739f04c98 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -446,10 +446,10 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
const char *cmd_name, *dimm_name;
unsigned long cmd_mask, dsm_mask;
u32 offset, fw_status = 0;
+ unsigned int family = 0;
acpi_handle handle;
const guid_t *guid;
int func, rc, i;
- int family = 0;
if (cmd_rc)
*cmd_rc = -EINVAL;
--
2.35.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2023-01-19 15:08 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-01-19 14:47 [PATCH] ACPI: NFIT: prevent underflow in acpi_nfit_ctl( Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox