diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-12-17 10:12:09 +0300 |
|---|---|---|
| committer | Hans de Goede <hdegoede@redhat.com> | 2021-12-21 18:57:14 +0100 |
| commit | 72e4d07d9499d979a3fc38c77f4120707c709ea5 (patch) | |
| tree | d50062f137ab7380737dbc3c0cf59ee34b9c135d /drivers/platform/x86/think-lmi.c | |
| parent | 855045873b54b9f8dd71a0468db9ff52aa27444f (diff) | |
| download | lwn-72e4d07d9499d979a3fc38c77f4120707c709ea5.tar.gz lwn-72e4d07d9499d979a3fc38c77f4120707c709ea5.zip | |
platform/x86: think-lmi: Prevent underflow in index_store()
There needs to be a check to prevent negative offsets for
setting->index. I have reviewed this code and I think that the
"if (block->instance_count <= instance)" check in __query_block() will
prevent this from resulting in an out of bounds access. But it's
still worth fixing.
Fixes: 640a5fa50a42 ("platform/x86: think-lmi: Opcode support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20211217071209.GF26548@kili
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Diffstat (limited to 'drivers/platform/x86/think-lmi.c')
| -rw-r--r-- | drivers/platform/x86/think-lmi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c index 27ab8e4e5b83..0b73e16cccea 100644 --- a/drivers/platform/x86/think-lmi.c +++ b/drivers/platform/x86/think-lmi.c @@ -573,7 +573,7 @@ static ssize_t index_store(struct kobject *kobj, if (err < 0) return err; - if (val > TLMI_INDEX_MAX) + if (val < 0 || val > TLMI_INDEX_MAX) return -EINVAL; setting->index = val; |