Patch "ACPI: APEI / ERST: Fix missing error handling in erst_reader()" has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

ACPI: APEI / ERST: Fix missing error handling in erst_reader()

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
acpi-apei-erst-fix-missing-error-handling-in-erst_reader.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Takashi Iwai <[email protected]>
Date: Thu, 14 Dec 2017 13:31:16 +0100
Subject: ACPI: APEI / ERST: Fix missing error handling in erst_reader()

From: Takashi Iwai <[email protected]>

commit bb82e0b4a7e96494f0c1004ce50cec3d7b5fb3d1 upstream.

The commit f6f828513290 ("pstore: pass allocated memory region back to caller") changed the check of the return value from erst_read() in erst_reader() in the following way:

        if (len == -ENOENT)
                goto skip;
-       else if (len < 0) {
-               rc = -1;
+       else if (len < sizeof(*rcd)) {
+               rc = -EIO;
                goto out;

This introduced another bug: since the comparison with sizeof() is cast to unsigned, a negative len value doesn't hit any longer. As a result, when an error is returned from erst_read(), the code falls through, and it may eventually lead to some weird thing like memory corruption.

This patch adds the negative error value check more explicitly for addressing the issue.

---
 drivers/acpi/apei/erst.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1007,7 +1007,7 @@ skip:
 	/* The record may be cleared by others, try read next record */
 	if (len == -ENOENT)
 		goto skip;
-	else if (len < sizeof(*rcd)) {
+	else if (len < 0 || len < sizeof(*rcd)) {
 		rc = -EIO;
 		goto out;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/alsa-usb-audio-fix-the-missing-ctl-name-suffix-at-parsing-su.patch queue-4.14/alsa-hda-add-vendor-id-for-cannonlake-hdmi-codec.patch queue-4.14/alsa-rawmidi-avoid-racy-info-ioctl-via-ctl-device.patch queue-4.14/alsa-usb-audio-add-native-dsd-support-for-esoteric-d-05x.patch queue-4.14/acpi-apei-erst-fix-missing-error-handling-in-erst_reader.patch queue-4.14/alsa-hda-realtek-fix-dell-aio-lineout-issue.patch