lkml.org 
[lkml]   [2020]   [Aug]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v3] memory: brcmstb_dpfe: fix array index out of bounds
On Sat, Aug 22, 2020 at 01:50:00PM -0700, Markus Mayer wrote:
> We would overrun the error_text array if we hit a TIMEOUT condition,
> because we were using the error code "ETIMEDOUT" (which is 110) as an
> array index.
>
> We fix the problem by correcting the array index and by providing a
> function to retrieve error messages rather than accessing the array
> directly. The function includes a bounds check that prevents the array
> from being overrun.
>
> This patch was prepared in response to
> https://lkml.org/lkml/2020/8/18/505.
>
> Signed-off-by: Markus Mayer <mmayer@broadcom.com>
> Acked-by: Florian Fainelli <f.fainelli@gmail.com>
> Fixes: 2f330caff577 ("memory: brcmstb: Add driver for DPFE")
> Reported-by: Colin Ian King <colin.king@canonical.com>
> ---
>
> Changes since v2:
> - Added "Fixes:" and "Reported-by:"
> - Fixed "From" address
> - No changes to the code
>
> Changes since v1:
> - Added link of the coverity report to the commit message.
> - Added Florian's ack.
> - Removed second "const" from get_error_text() return type
> (thanks to the kernel test robot).
>
> drivers/memory/brcmstb_dpfe.c | 23 ++++++++++++++++-------
> 1 file changed, 16 insertions(+), 7 deletions(-)

"From" and SoB look good now.

Thanks, applied.

Best regards,
Krzysztof

\
 
 \ /
  Last update: 2020-08-22 22:57    [W:0.053 / U:25.372 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site