public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] driver core: Prevent overflow from causing infinite loops
@ 2019-12-10 22:41 Simon Schwartz
  2019-12-11  8:18 ` Greg KH
  2019-12-20  7:51 ` [driver core] ffbb97fa23: BUG:kernel_NULL_pointer_dereference,address kernel test robot
  0 siblings, 2 replies; 3+ messages in thread
From: Simon Schwartz @ 2019-12-10 22:41 UTC (permalink / raw)
  To: gregkh, rafael, linux-kernel

num_resources in the platform_device struct is declared as a u32.
The for loops that iterate over num_resources use an int as the counter,
which can cause infinite loops on architectures with smaller ints.
Change the loop counters to u32.

Signed-off-by: Simon Schwartz <kern.simon@theschwartz.xyz>
---
 drivers/base/platform.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 7c532548b0a6..9073c83fc5dd 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -27,6 +27,7 @@
 #include <linux/limits.h>
 #include <linux/property.h>
 #include <linux/kmemleak.h>
+#include <linux/types.h>
 
 #include "base.h"
 #include "power/power.h"
@@ -48,7 +49,7 @@ EXPORT_SYMBOL_GPL(platform_bus);
 struct resource *platform_get_resource(struct platform_device *dev,
 				       unsigned int type, unsigned int num)
 {
-	int i;
+	u32 i;
 
 	for (i = 0; i < dev->num_resources; i++) {
 		struct resource *r = &dev->resource[i];
@@ -255,7 +256,7 @@ struct resource *platform_get_resource_byname(struct platform_device *dev,
 					      unsigned int type,
 					      const char *name)
 {
-	int i;
+	u32 i;
 
 	for (i = 0; i < dev->num_resources; i++) {
 		struct resource *r = &dev->resource[i];
@@ -501,7 +502,8 @@ EXPORT_SYMBOL_GPL(platform_device_add_properties);
  */
 int platform_device_add(struct platform_device *pdev)
 {
-	int i, ret;
+	u32 i;
+	int ret;
 
 	if (!pdev)
 		return -EINVAL;
@@ -590,7 +592,7 @@ EXPORT_SYMBOL_GPL(platform_device_add);
  */
 void platform_device_del(struct platform_device *pdev)
 {
-	int i;
+	u32 i;
 
 	if (!IS_ERR_OR_NULL(pdev)) {
 		device_del(&pdev->dev);



^ permalink raw reply related	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-12-20  7:52 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-12-10 22:41 [PATCH] driver core: Prevent overflow from causing infinite loops Simon Schwartz
2019-12-11  8:18 ` Greg KH
2019-12-20  7:51 ` [driver core] ffbb97fa23: BUG:kernel_NULL_pointer_dereference,address kernel test robot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox