Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 49204c11 authored by Antti P Miettinen's avatar Antti P Miettinen Committed by Linus Torvalds
Browse files

block/partitions/efi.c: fix bound check 



Use ARRAY_SIZE instead of sizeof to get proper max for label length.

Since this is just a read out of bounds it's not that bad, but the
problem becomes user-visible eg if one tries to use DEBUG_PAGEALLOC and
DEBUG_RODATA, at least with some enhancements from Hiroshi.  Of course
the destination array can contain garbage when we read beyond the end of
source array so that would be another user-visible problem.

Signed-off-by: default avatarAntti P Miettinen <amiettinen@nvidia.com>
Reviewed-by: default avatarHiroshi Doyu <hdoyu@nvidia.com>
Tested-by: default avatarHiroshi Doyu <hdoyu@nvidia.com>
Cc: Will Drewry <wad@chromium.org>
Cc: Matt Fleming <matt.fleming@intel.com>
Acked-by: default avatarDavidlohr Bueso <davidlohr@hp.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 51a0d036

block/partitions/efi.c

+3 −2
Original line number Diff line number Diff line
@@ -96,6 +96,7 @@ 
 * - Code works, detects all the partitions.

 *

 ************************************************************/

#include <linux/kernel.h>

#include <linux/crc32.h>

#include <linux/ctype.h>

#include <linux/math64.h>
@@ -715,8 +716,8 @@ int efi_partition(struct parsed_partitions *state) 
		efi_guid_unparse(&ptes[i].unique_partition_guid, info->uuid);



		/* Naively convert UTF16-LE to 7 bits. */

		label_max = min(sizeof(info->volname) - 1,

				sizeof(ptes[i].partition_name));

		label_max = min(ARRAY_SIZE(info->volname) - 1,

				ARRAY_SIZE(ptes[i].partition_name));

		info->volname[label_max] = 0;

		while (label_count < label_max) {

			u8 c = ptes[i].partition_name[label_count] & 0xff;