redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

staging: ramster: fix range checks in zcache_autocreate_pool()

Browse source 
If "pool_id" is negative then it leads to a read before the start of the
array.  If "cli_id" is out of bounds then it leads to a NULL dereference
of "cli".  GCC would have warned about that bug except that we
initialized the warning message away.

Also it's better to put the parameter names into the function
declaration in the .h file.  It serves as a kind of documentation.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2012-09-06 15:40:20 +03:00 committed by Greg Kroah-Hartman
parent d08d6cfe3b
commit f0290de23d
2 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/staging/ramster/zcache-main.c
View file

@ -1338,10 +1338,10 @@ static int zcache_local_new_pool(uint32_t flags)
return zcache_new_pool(LOCAL_CLIENT, flags);
}
int zcache_autocreate_pool(int cli_id, int pool_id, bool eph)
int zcache_autocreate_pool(unsigned int cli_id, unsigned int pool_id, bool eph)
{
struct tmem_pool *pool;
struct zcache_client *cli = NULL;
struct zcache_client *cli;
uint32_t flags = eph ? 0 : TMEM_POOL_PERSIST;
int ret = -1;
@ -1350,8 +1350,10 @@ int zcache_autocreate_pool(int cli_id, int pool_id, bool eph)
goto out;
if (pool_id >= MAX_POOLS_PER_CLIENT)
goto out;
else if ((unsigned int)cli_id < MAX_CLIENTS)
cli = &zcache_clients[cli_id];
if (cli_id >= MAX_CLIENTS)
goto out;
cli = &zcache_clients[cli_id];
if ((eph && disable_cleancache) || (!eph && disable_frontswap)) {
pr_err("zcache_autocreate_pool: pool type disabled\n");
goto out;

2
drivers/staging/ramster/zcache.h
View file

@ -42,7 +42,7 @@ extern void zcache_decompress_to_page(char *, unsigned int, struct page *);
#ifdef CONFIG_RAMSTER
extern void *zcache_pampd_create(char *, unsigned int, bool, int,
struct tmem_handle *);
extern int zcache_autocreate_pool(int, int, bool);
int zcache_autocreate_pool(unsigned int cli_id, unsigned int pool_id, bool eph);
#endif
#define MAX_POOLS_PER_CLIENT 16