diff options
| author | Arve Hjønnevåg <arve@android.com> | 2012-12-11 17:49:24 -0800 |
|---|---|---|
| committer | Anton Vorontsov <anton.vorontsov@linaro.org> | 2012-12-12 19:02:52 -0800 |
| commit | c628937803c652132d21f383736375e2feee4bfb (patch) | |
| tree | 41ebffb3fe0b787c34ba2c45f860336f5d27e0ca /fs/pstore | |
| parent | b042e47491ba5f487601b5141a3f1d8582304170 (diff) | |
pstore/ram: Fix bounds checks for mem_size, record_size, console_size and ftrace_size
The bounds check in ramoops_init_prz was incorrect and ramoops_init_przs
had no check. Additionally, ramoops_init_przs allows record_size to be 0,
but ramoops_pstore_write_buf would always crash in this case.
Signed-off-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
Diffstat (limited to 'fs/pstore')
| -rw-r--r-- | fs/pstore/ram.c | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c index 8741cea6253..dba70e53b72 100644 --- a/fs/pstore/ram.c +++ b/fs/pstore/ram.c @@ -189,7 +189,7 @@ static int notrace ramoops_pstore_write_buf(enum pstore_type_id type, struct pstore_info *psi) { struct ramoops_context *cxt = psi->data; - struct persistent_ram_zone *prz = cxt->przs[cxt->dump_write_cnt]; + struct persistent_ram_zone *prz; size_t hlen; if (type == PSTORE_TYPE_CONSOLE) { @@ -226,6 +226,11 @@ static int notrace ramoops_pstore_write_buf(enum pstore_type_id type, if (part != 1) return -ENOSPC; + if (!cxt->przs) + return -ENOSPC; + + prz = cxt->przs[cxt->dump_write_cnt]; + hlen = ramoops_write_kmsg_hdr(prz); if (size + hlen > prz->buffer_size) size = prz->buffer_size - hlen; @@ -297,6 +302,11 @@ static int __devinit ramoops_init_przs(struct device *dev, if (!cxt->record_size) return 0; + if (*paddr + dump_mem_sz - cxt->phys_addr > cxt->size) { + dev_err(dev, "no room for dumps\n"); + return -ENOMEM; + } + cxt->max_dump_cnt = dump_mem_sz / cxt->record_size; if (!cxt->max_dump_cnt) return -ENOMEM; @@ -335,8 +345,12 @@ static int __devinit ramoops_init_prz(struct device *dev, if (!sz) return 0; - if (*paddr + sz > *paddr + cxt->size) + if (*paddr + sz - cxt->phys_addr > cxt->size) { + dev_err(dev, "no room for mem region (0x%zx@0x%llx) in (0x%lx@0x%llx)\n", + sz, (unsigned long long)*paddr, + cxt->size, (unsigned long long)cxt->phys_addr); return -ENOMEM; + } *prz = persistent_ram_new(*paddr, sz, sig, cxt->ecc_size); if (IS_ERR(*prz)) { |