Skip to content

Commit

Permalink
powerpc/powernv: Fix the overflow of OPAL message notifiers head array
Browse files Browse the repository at this point in the history
Fixes the condition check of incoming message type which can
otherwise shoot beyond the message notifiers head array.

Signed-off-by: Neelesh Gupta <neelegup@linux.vnet.ibm.com>
Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Reviewed-by: Anshuman Khandual <khandual@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  • Loading branch information
Neelesh Gupta authored and Benjamin Herrenschmidt committed Mar 25, 2015
1 parent 111fbc6 commit 792f96e
Showing 1 changed file with 4 additions and 8 deletions.
12 changes: 4 additions & 8 deletions arch/powerpc/platforms/powernv/opal.c
Original file line number Diff line number Diff line change
Expand Up @@ -308,16 +308,12 @@ void opal_notifier_disable(void)
int opal_message_notifier_register(enum OpalMessageType msg_type,
struct notifier_block *nb)
{
if (!nb) {
pr_warning("%s: Invalid argument (%p)\n",
__func__, nb);
return -EINVAL;
}
if (msg_type > OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Invalid message type argument (%d)\n",
if (!nb || msg_type >= OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Invalid arguments, msg_type:%d\n",
__func__, msg_type);
return -EINVAL;
}

return atomic_notifier_chain_register(
&opal_msg_notifier_head[msg_type], nb);
}
Expand Down Expand Up @@ -354,7 +350,7 @@ static void opal_handle_message(void)
type = be32_to_cpu(msg.msg_type);

/* Sanity check */
if (type > OPAL_MSG_TYPE_MAX) {
if (type >= OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Unknown message type: %u\n", __func__, type);
return;
}
Expand Down

0 comments on commit 792f96e

Please sign in to comment.