[PATCH v2 3/4] soc: apple: rtkit: reject syslog indices outside the entry count

Laxman Acharya Padhya <[email protected]>
Newsgroups dev.linux.lists.asahi,org.infradead.lists.linux-arm-kernel,org.kernel.vger.linux-kernel,org.kernel.vger.stable
Message-ID <930eb129c35cdffb877b8fd16662a3250a0e2ecf.1787559303.git.acharyalaxman8848@gmail.com>
syslog_n_entries is a count, so valid indices range from zero through
syslog_n_entries - 1. The current check also accepts syslog_n_entries
itself.

Reject that index before deriving the shared-buffer offset. The shared
copy bounds check remains the final protection against inconsistent
firmware-provided layouts.

Fixes: 9bd1d9a0d8bb ("soc: apple: Add RTKit IPC library")
Cc: [email protected]
Signed-off-by: Laxman Acharya Padhya <[email protected]>
---
 drivers/soc/apple/rtkit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/apple/rtkit.c b/drivers/soc/apple/rtkit.c
index 2e62f9b3c948..da766df5a6d7 100644
--- a/drivers/soc/apple/rtkit.c
+++ b/drivers/soc/apple/rtkit.c
@@ -481,7 +481,7 @@ static void apple_rtkit_syslog_rx_log(struct apple_rtkit *rtk, u64 msg)
 			"RTKit: received syslog message but no syslog_buffer.buffer or syslog_buffer.iomem\n");
 		goto done;
 	}
-	if (idx > rtk->syslog_n_entries) {
+	if (idx >= rtk->syslog_n_entries) {
 		dev_warn(rtk->dev, "RTKit: syslog index %d out of range\n",
 			 idx);
 		goto done;
-- 
2.51.2
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.