Skip to content

Commit

Permalink
serial: mxs-auart: Fix potential infinite loop
Browse files Browse the repository at this point in the history
On the error path of mxs_auart_request_gpio_irq() is performed
backward iterating with index i of enum type. Underline enum type
may be unsigned char. In this case check (--i >= 0) will be always
true and error handling goes into infinite loop.

The patch changes the check so that it is valid for signed and unsigned
types.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Anton Vasilyev authored and Greg Kroah-Hartman committed Sep 18, 2018
1 parent d2de960 commit 5963e8a
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/tty/serial/mxs-auart.c
Original file line number Diff line number Diff line change
Expand Up @@ -1634,8 +1634,9 @@ static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s)

/*
* If something went wrong, rollback.
* Be careful: i may be unsigned.
*/
while (err && (--i >= 0))
while (err && (i-- > 0))
if (irq[i] >= 0)
free_irq(irq[i], s);

Expand Down

0 comments on commit 5963e8a

Please sign in to comment.