lkml.org 
[lkml]   [2016]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19.y-ckt 027/196] intel_scu_ipcutil: underflow in scu_reg_access()
    Date
    3.19.8-ckt16 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit b1d353ad3d5835b16724653b33c05124e1b5acf1 upstream.

    "count" is controlled by the user and it can be negative. Let's prevent
    that by making it unsigned. You have to have CAP_SYS_RAWIO to call this
    function so the bug is not as serious as it could be.

    Fixes: 5369c02d951a ('intel_scu_ipc: Utility driver for intel scu ipc')
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Darren Hart <dvhart@linux.intel.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/platform/x86/intel_scu_ipcutil.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/platform/x86/intel_scu_ipcutil.c b/drivers/platform/x86/intel_scu_ipcutil.c
    index 02bc5a6..aa45424 100644
    --- a/drivers/platform/x86/intel_scu_ipcutil.c
    +++ b/drivers/platform/x86/intel_scu_ipcutil.c
    @@ -49,7 +49,7 @@ struct scu_ipc_data {

    static int scu_reg_access(u32 cmd, struct scu_ipc_data *data)
    {
    - int count = data->count;
    + unsigned int count = data->count;

    if (count == 0 || count == 3 || count > 4)
    return -EINVAL;
    --
    2.7.0
    \
     
     \ /
      Last update: 2016-03-09 03:01    [W:4.247 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site