hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

mtd: docg3: off by one in doc_register_sysfs() 

Smatch found a bug in the error handling:

	drivers/mtd/devices/docg3.c:1634 doc_register_sysfs()
	error: buffer overflow 'doc_sys_attrs' 4 <= 4

The problem is that if the very last device_create_file() fails, then we
are beyond the end of the array.  Actually, any time i == 3 then there
is a problem.  We can fix this an simplify the code at the same time by
moving the !ret conditions out of the for loops and using a goto
instead.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
This commit is contained in:
Dan Carpenter 2015-10-19 13:20:05 +03:00 committed by Brian Norris
parent 89c1702da7
commit 2382960793
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/mtd/devices/docg3.c
View File

@ -1620,20 +1620,30 @@ static struct device_attribute doc_sys_attrs[DOC_MAX_NBFLOORS][4] = {
static int doc_register_sysfs(struct platform_device *pdev, static int doc_register_sysfs(struct platform_device *pdev,
struct docg3_cascade *cascade) struct docg3_cascade *cascade)
{ {
int ret = 0, floor, i = 0;
struct device *dev = &pdev->dev; struct device *dev = &pdev->dev;
int floor;
int ret;
int i;
for (floor = 0; !ret && floor < DOC_MAX_NBFLOORS && for (floor = 0;
cascade->floors[floor]; floor++) floor < DOC_MAX_NBFLOORS && cascade->floors[floor];
for (i = 0; !ret && i < 4; i++) floor++) {
for (i = 0; i < 4; i++) {
ret = device_create_file(dev, &doc_sys_attrs[floor][i]); ret = device_create_file(dev, &doc_sys_attrs[floor][i]);
if (!ret) if (ret)
return 0; goto remove_files;
}
}
return 0;
remove_files:
do { do {
while (--i >= 0) while (--i >= 0)
device_remove_file(dev, &doc_sys_attrs[floor][i]); device_remove_file(dev, &doc_sys_attrs[floor][i]);
i = 4; i = 4;
} while (--floor >= 0); } while (--floor >= 0);
return ret; return ret;
} }