From 142cb2021a65e89d6408f4264ba87c775efbe277 Mon Sep 17 00:00:00 2001 From: Neelesh Gupta Date: Wed, 11 Feb 2015 11:57:06 +0530 Subject: [PATCH] powerpc/powernv: Fix the overflow of OPAL message notifiers head array commit 792f96e9a769b799a2944e9369e4ea1e467135b2 upstream. Fixes the condition check of incoming message type which can otherwise shoot beyond the message notifiers head array. Signed-off-by: Neelesh Gupta Reviewed-by: Vasant Hegde Reviewed-by: Anshuman Khandual Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Luis Henriques --- arch/powerpc/platforms/powernv/opal.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c index 199975613fe99..d5e5794db9893 100644 --- a/arch/powerpc/platforms/powernv/opal.c +++ b/arch/powerpc/platforms/powernv/opal.c @@ -286,16 +286,12 @@ void opal_notifier_disable(void) int opal_message_notifier_register(enum OpalMessageType msg_type, struct notifier_block *nb) { - if (!nb) { - pr_warning("%s: Invalid argument (%p)\n", - __func__, nb); - return -EINVAL; - } - if (msg_type > OPAL_MSG_TYPE_MAX) { - pr_warning("%s: Invalid message type argument (%d)\n", + if (!nb || msg_type >= OPAL_MSG_TYPE_MAX) { + pr_warning("%s: Invalid arguments, msg_type:%d\n", __func__, msg_type); return -EINVAL; } + return atomic_notifier_chain_register( &opal_msg_notifier_head[msg_type], nb); } @@ -332,7 +328,7 @@ static void opal_handle_message(void) type = be32_to_cpu(msg.msg_type); /* Sanity check */ - if (type > OPAL_MSG_TYPE_MAX) { + if (type >= OPAL_MSG_TYPE_MAX) { pr_warning("%s: Unknown message type: %u\n", __func__, type); return; } -- 2.47.3