Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 792f96e9 authored by Neelesh Gupta's avatar Neelesh Gupta Committed by Benjamin Herrenschmidt
Browse files

powerpc/powernv: Fix the overflow of OPAL message notifiers head array 



Fixes the condition check of incoming message type which can
otherwise shoot beyond the message notifiers head array.

Signed-off-by: default avatarNeelesh Gupta <neelegup@linux.vnet.ibm.com>
Reviewed-by: default avatarVasant Hegde <hegdevasant@linux.vnet.ibm.com>
Reviewed-by: default avatarAnshuman Khandual <khandual@linux.vnet.ibm.com>
Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
parent 111fbc68

arch/powerpc/platforms/powernv/opal.c

+4 −8
Original line number Diff line number Diff line
@@ -308,16 +308,12 @@ void opal_notifier_disable(void) 
int opal_message_notifier_register(enum OpalMessageType msg_type,

					struct notifier_block *nb)

{

	if (!nb) {

		pr_warning("%s: Invalid argument (%p)\n",

			   __func__, nb);

		return -EINVAL;

	}

	if (msg_type > OPAL_MSG_TYPE_MAX) {

		pr_warning("%s: Invalid message type argument (%d)\n",

	if (!nb || msg_type >= OPAL_MSG_TYPE_MAX) {

		pr_warning("%s: Invalid arguments, msg_type:%d\n",

			   __func__, msg_type);

		return -EINVAL;

	}



	return atomic_notifier_chain_register(

				&opal_msg_notifier_head[msg_type], nb);

}
@@ -354,7 +350,7 @@ static void opal_handle_message(void) 
	type = be32_to_cpu(msg.msg_type);



	/* Sanity check */

	if (type > OPAL_MSG_TYPE_MAX) {

	if (type >= OPAL_MSG_TYPE_MAX) {

		pr_warning("%s: Unknown message type: %u\n", __func__, type);

		return;

	}