Skip to content
Commit bb82e0b4 authored by Takashi Iwai's avatar Takashi Iwai Committed by Rafael J. Wysocki
Browse files

ACPI: APEI / ERST: Fix missing error handling in erst_reader()



The commit f6f82851 ("pstore: pass allocated memory region back to
caller") changed the check of the return value from erst_read() in
erst_reader() in the following way:

        if (len == -ENOENT)
                goto skip;
-       else if (len < 0) {
-               rc = -1;
+       else if (len < sizeof(*rcd)) {
+               rc = -EIO;
                goto out;

This introduced another bug: since the comparison with sizeof() is
cast to unsigned, a negative len value doesn't hit any longer.
As a result, when an error is returned from erst_read(), the code
falls through, and it may eventually lead to some weird thing like
memory corruption.

This patch adds the negative error value check more explicitly for
addressing the issue.

Fixes: f6f82851 (pstore: pass allocated memory region back to caller)
Cc: All applicable <stable@vger.kernel.org>
Tested-by: default avatarJerry Tang <jtang@suse.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
parent 1291a0d5
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment