mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 02:30:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

of/selftest: Fix off-by-one error in removal path

Browse source 
The removal path for selftest data has an off by one error that causes
the code to dereference beyond the end of the nodes[] array on the first
pass through. The old code only worked by chance on a lot of platforms,
but the bug was recently exposed on aarch64.

The fix is simple. Decrement the node count before dereferencing, not
after.

Reported-by: Kevin Hilman <khilman@linaro.org>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: Gaurav Minocha <gaurav.minocha.os@gmail.com>
Cc: <stable@vger.kernel.org> # v3.17+
This commit is contained in:
Grant Likely 2014-11-19 16:22:32 +00:00
parent a0e27f51ba
commit c1a2086e2d
1 changed files with 1 additions and 2 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/of/selftest.c
View file

@ -896,7 +896,7 @@ static void selftest_data_remove(void)
return; return;
} }
while (last_node_index >= 0) { while (last_node_index-- > 0) {
if (nodes[last_node_index]) { if (nodes[last_node_index]) {
np = of_find_node_by_path(nodes[last_node_index]->full_name); np = of_find_node_by_path(nodes[last_node_index]->full_name);
if (strcmp(np->full_name, "/aliases") != 0) { if (strcmp(np->full_name, "/aliases") != 0) {
@ -908,7 +908,6 @@ static void selftest_data_remove(void)
} }
} }
} }
last_node_index--;
} }
} }