All of lore.kernel.org
 help / color / mirror / Atom feed
From: Oscar Carter <oscar.carter@gmx.com>
To: Rob Springer <rspringer@google.com>,
	Todd Poynor <toddpoynor@google.com>,
	Ben Chan <benchan@chromium.org>, Richard Yeh <rcy@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Simon Que <sque@chromium.org>, John Joseph <jnjoseph@google.com>,
	devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org,
	Oscar Carter <oscar.carter@gmx.com>
Subject: [PATCH] staging: gasket: Check the return value of gasket_get_bar_index()
Date: Fri,  1 May 2020 17:51:18 +0200	[thread overview]
Message-ID: <20200501155118.13380-1-oscar.carter@gmx.com> (raw)

Check the return value of gasket_get_bar_index function as it can return
a negative one (-EINVAL). If this happens, a negative index is used in
the "gasket_dev->bar_data" array.

Addresses-Coverity-ID: 1438542 ("Negative array index read")
Fixes: 9a69f5087ccc2 ("drivers/staging: Gasket driver framework + Apex driver")
Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
---
 drivers/staging/gasket/gasket_core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/gasket/gasket_core.c b/drivers/staging/gasket/gasket_core.c
index 8e0575fcb4c8..67325fbaf760 100644
--- a/drivers/staging/gasket/gasket_core.c
+++ b/drivers/staging/gasket/gasket_core.c
@@ -925,6 +925,10 @@ do_map_region(const struct gasket_dev *gasket_dev, struct vm_area_struct *vma,
 		gasket_get_bar_index(gasket_dev,
 				     (vma->vm_pgoff << PAGE_SHIFT) +
 				     driver_desc->legacy_mmap_address_offset);
+
+	if (bar_index < 0)
+		return DO_MAP_REGION_INVALID;
+
 	phys_base = gasket_dev->bar_data[bar_index].phys_base + phys_offset;
 	while (mapped_bytes < map_length) {
 		/*
--
2.20.1


WARNING: multiple messages have this Message-ID (diff)
From: Oscar Carter <oscar.carter@gmx.com>
To: Rob Springer <rspringer@google.com>,
	Todd Poynor <toddpoynor@google.com>,
	Ben Chan <benchan@chromium.org>, Richard Yeh <rcy@google.com>
Cc: devel@driverdev.osuosl.org, Oscar Carter <oscar.carter@gmx.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	John Joseph <jnjoseph@google.com>,
	linux-kernel@vger.kernel.org, Simon Que <sque@chromium.org>
Subject: [PATCH] staging: gasket: Check the return value of gasket_get_bar_index()
Date: Fri,  1 May 2020 17:51:18 +0200	[thread overview]
Message-ID: <20200501155118.13380-1-oscar.carter@gmx.com> (raw)

Check the return value of gasket_get_bar_index function as it can return
a negative one (-EINVAL). If this happens, a negative index is used in
the "gasket_dev->bar_data" array.

Addresses-Coverity-ID: 1438542 ("Negative array index read")
Fixes: 9a69f5087ccc2 ("drivers/staging: Gasket driver framework + Apex driver")
Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
---
 drivers/staging/gasket/gasket_core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/gasket/gasket_core.c b/drivers/staging/gasket/gasket_core.c
index 8e0575fcb4c8..67325fbaf760 100644
--- a/drivers/staging/gasket/gasket_core.c
+++ b/drivers/staging/gasket/gasket_core.c
@@ -925,6 +925,10 @@ do_map_region(const struct gasket_dev *gasket_dev, struct vm_area_struct *vma,
 		gasket_get_bar_index(gasket_dev,
 				     (vma->vm_pgoff << PAGE_SHIFT) +
 				     driver_desc->legacy_mmap_address_offset);
+
+	if (bar_index < 0)
+		return DO_MAP_REGION_INVALID;
+
 	phys_base = gasket_dev->bar_data[bar_index].phys_base + phys_offset;
 	while (mapped_bytes < map_length) {
 		/*
--
2.20.1

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

             reply	other threads:[~2020-05-01 15:51 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-01 15:51 Oscar Carter [this message]
2020-05-01 15:51 ` [PATCH] staging: gasket: Check the return value of gasket_get_bar_index() Oscar Carter
     [not found] ` <CANJCoRvCUFkRuSSM0egkMuAd5+kzve4CWvhQ3KkppZBSM8PGkw@mail.gmail.com>
2020-05-03  7:47   ` Greg Kroah-Hartman
2020-05-03  7:47     ` Greg Kroah-Hartman
2020-05-04 17:49 ` Richard Yeh
2020-05-04 17:49   ` Richard Yeh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200501155118.13380-1-oscar.carter@gmx.com \
    --to=oscar.carter@gmx.com \
    --cc=benchan@chromium.org \
    --cc=devel@driverdev.osuosl.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=jnjoseph@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=rcy@google.com \
    --cc=rspringer@google.com \
    --cc=sque@chromium.org \
    --cc=toddpoynor@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.