Messages in this thread | | | Date | Sat, 22 Aug 2020 22:56:33 +0200 | From | Krzysztof Kozlowski <> | Subject | Re: [PATCH v3] memory: brcmstb_dpfe: fix array index out of bounds |
| |
On Sat, Aug 22, 2020 at 01:50:00PM -0700, Markus Mayer wrote: > We would overrun the error_text array if we hit a TIMEOUT condition, > because we were using the error code "ETIMEDOUT" (which is 110) as an > array index. > > We fix the problem by correcting the array index and by providing a > function to retrieve error messages rather than accessing the array > directly. The function includes a bounds check that prevents the array > from being overrun. > > This patch was prepared in response to > https://lkml.org/lkml/2020/8/18/505. > > Signed-off-by: Markus Mayer <mmayer@broadcom.com> > Acked-by: Florian Fainelli <f.fainelli@gmail.com> > Fixes: 2f330caff577 ("memory: brcmstb: Add driver for DPFE") > Reported-by: Colin Ian King <colin.king@canonical.com> > --- > > Changes since v2: > - Added "Fixes:" and "Reported-by:" > - Fixed "From" address > - No changes to the code > > Changes since v1: > - Added link of the coverity report to the commit message. > - Added Florian's ack. > - Removed second "const" from get_error_text() return type > (thanks to the kernel test robot). > > drivers/memory/brcmstb_dpfe.c | 23 ++++++++++++++++------- > 1 file changed, 16 insertions(+), 7 deletions(-)
"From" and SoB look good now.
Thanks, applied.
Best regards, Krzysztof
| |