Commit 792f96e9 authored by Neelesh Gupta's avatar Neelesh Gupta Committed by Benjamin Herrenschmidt

powerpc/powernv: Fix the overflow of OPAL message notifiers head array

Fixes the condition check of incoming message type which can
otherwise shoot beyond the message notifiers head array.
Signed-off-by: default avatarNeelesh Gupta <neelegup@linux.vnet.ibm.com>
Reviewed-by: default avatarVasant Hegde <hegdevasant@linux.vnet.ibm.com>
Reviewed-by: default avatarAnshuman Khandual <khandual@linux.vnet.ibm.com>
Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
parent 111fbc68
...@@ -308,16 +308,12 @@ void opal_notifier_disable(void) ...@@ -308,16 +308,12 @@ void opal_notifier_disable(void)
int opal_message_notifier_register(enum OpalMessageType msg_type, int opal_message_notifier_register(enum OpalMessageType msg_type,
struct notifier_block *nb) struct notifier_block *nb)
{ {
if (!nb) { if (!nb || msg_type >= OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Invalid argument (%p)\n", pr_warning("%s: Invalid arguments, msg_type:%d\n",
__func__, nb);
return -EINVAL;
}
if (msg_type > OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Invalid message type argument (%d)\n",
__func__, msg_type); __func__, msg_type);
return -EINVAL; return -EINVAL;
} }
return atomic_notifier_chain_register( return atomic_notifier_chain_register(
&opal_msg_notifier_head[msg_type], nb); &opal_msg_notifier_head[msg_type], nb);
} }
...@@ -354,7 +350,7 @@ static void opal_handle_message(void) ...@@ -354,7 +350,7 @@ static void opal_handle_message(void)
type = be32_to_cpu(msg.msg_type); type = be32_to_cpu(msg.msg_type);
/* Sanity check */ /* Sanity check */
if (type > OPAL_MSG_TYPE_MAX) { if (type >= OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Unknown message type: %u\n", __func__, type); pr_warning("%s: Unknown message type: %u\n", __func__, type);
return; return;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment