powerpc:beyond ARRAY_SIZE of args.args
PATCH 1/1 powerpc:beyond ARRAY_SIZE of args.args
Do not go beyond ARRAY_SIZE of args.args
Signed-off-by Roel Kluin <[email protected]>
---
I'm quite sure the first is correct, but should maybe args.nret' and nargs + args.nret' also be `>= ARRAY_SIZE(args.args)'?
arch/powerpc/kernel/rtas.c +1 -1
@@ -779,7 +779,7 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs)return -EFAULT ; nargs = args.nargs; -if (nargs >ARRAY_SIZE (args.args) +if (nargs >=ARRAY_SIZE (args.args) || args.nret >ARRAY_SIZE (args.args) || nargs + args.nret >ARRAY_SIZE (args.args))return -EINVAL ;
Quoted 6 lines · Roel Kluin
Do not go beyond
ARRAY_SIZEof args.argsSigned-off-by Roel Kluin <[email protected]>---
I'm quite sure the first is correct, but should maybeargs.nret' andnargs + args.nret' also be `>=ARRAY_SIZE(args.args)'?
I don't think this change is needed, and it changes a user-visible API, so I'm nacking it unless you can convince me there's really a problem.
If nargs == ARRAY_SIZE(args.args), then args.nret must be zero, so nothing will access *(args.rets).
Paul.