[PATCH v2 3/4] soc: apple: rtkit: reject syslog indices outside the entry count
Laxman Acharya Padhya <[email protected]>
| Newsgroups | dev.linux.lists.asahi,org.infradead.lists.linux-arm-kernel,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <930eb129c35cdffb877b8fd16662a3250a0e2ecf.1787559303.git.acharyalaxman8848@gmail.com> |
syslog_n_entries is a count, so valid indices range from zero through
syslog_n_entries - 1. The current check also accepts syslog_n_entries
itself.
Reject that index before deriving the shared-buffer offset. The shared
copy bounds check remains the final protection against inconsistent
firmware-provided layouts.
Fixes: 9bd1d9a0d8bb ("soc: apple: Add RTKit IPC library")
Cc: [email protected]
Signed-off-by: Laxman Acharya Padhya <[email protected]>
---
drivers/soc/apple/rtkit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/apple/rtkit.c b/drivers/soc/apple/rtkit.c
index 2e62f9b3c948..da766df5a6d7 100644
--- a/drivers/soc/apple/rtkit.c
+++ b/drivers/soc/apple/rtkit.c
@@ -481,7 +481,7 @@ static void apple_rtkit_syslog_rx_log(struct apple_rtkit *rtk, u64 msg)
"RTKit: received syslog message but no syslog_buffer.buffer or syslog_buffer.iomem\n");
goto done;
}
- if (idx > rtk->syslog_n_entries) {
+ if (idx >= rtk->syslog_n_entries) {
dev_warn(rtk->dev, "RTKit: syslog index %d out of range\n",
idx);
goto done;
--
2.51.2