Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1516183

[PATCH 3.12 07/72] pstore: Fix buffer overflow while write offset equal to buffer size

Show all headers | View raw

From: Liu ShuoX <shuox.liu@intel.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 017321cf390045dd4c4afc4a232995ea50bcf66d upstream.

In case new offset is equal to prz->buffer_size, it won't wrap at this
time and will return old(overflow) value next time.

Signed-off-by: Liu ShuoX <shuox.liu@intel.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/pstore/ram_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
index bda61a759b68..0b367ef7a7d6 100644
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -54,7 +54,7 @@ static size_t buffer_start_add_atomic(struct persistent_ram_zone *prz, size_t a)
 	do {
 		old = atomic_read(&prz->buffer->start);
 		new = old + a;
-		while (unlikely(new > prz->buffer_size))
+		while (unlikely(new >= prz->buffer_size))
 			new -= prz->buffer_size;
 	} while (atomic_cmpxchg(&prz->buffer->start, old, new) != old);
 
@@ -91,7 +91,7 @@ static size_t buffer_start_add_locked(struct persistent_ram_zone *prz, size_t a)
 
 	old = atomic_read(&prz->buffer->start);
 	new = old + a;
-	while (unlikely(new > prz->buffer_size))
+	while (unlikely(new >= prz->buffer_size))
 		new -= prz->buffer_size;
 	atomic_set(&prz->buffer->start, new);
 
-- 
2.10.2

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.12 00/72] 3.12.67-stable review Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:10 +0100
  [PATCH 3.12 01/72] i40e: avoid NULL pointer dereference and recursive errors on early PCI error Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 03/72] scsi: ibmvfc: Fix I/O hang when port is not mapped Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 19/72] powerpc/pseries: Fix stack corruption in htpe code Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 10/72] regulator: tps65910: Work around silicon erratum SWCZ010 Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 15/72] dm: mark request_queue dead before destroying the DM device Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 16/72] powerpc/vdso64: Use double word compare on pointers Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 22/72] zfcp: close window with unblocked rport during rport gone Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 09/72] gpio: mpc8xxx: Correct irq handler function Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 23/72] zfcp: retain trace level for SCSI and HBA FSF response records Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 07/72] pstore: Fix buffer overflow while write offset equal to buffer size Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 06/72] cfq: fix starvation of asynchronous writes Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 08/72] ipc: remove use of seq_printf return value Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 17/72] powerpc/powernv: Use CPU-endian PEST in pnv_pci_dump_p7ioc_diag_data() Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
    [PATCH 3.12 20/72] zfcp: fix fc_host port_type with NPIV Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:30 +0100
  [PATCH 3.12 62/72] powerpc/eeh: Null check uses of eeh_pe_bus_get Jiri Slaby <jslaby@suse.cz> - 2016-11-07 14:40 +0100
  Re: [PATCH 3.12 00/72] 3.12.67-stable review Guenter Roeck <linux@roeck-us.net> - 2016-11-07 18:20 +0100
    Re: [PATCH 3.12 00/72] 3.12.67-stable review Jiri Slaby <jslaby@suse.cz> - 2016-11-08 16:50 +0100
      Re: [PATCH 3.12 00/72] 3.12.67-stable review Guenter Roeck <linux@roeck-us.net> - 2016-11-09 05:20 +0100
        Re: [PATCH 3.12 00/72] 3.12.67-stable review Jiri Slaby <jslaby@suse.cz> - 2016-11-10 20:00 +0100
  Re: [PATCH 3.12 00/72] 3.12.67-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-11-07 19:40 +0100
    Re: [PATCH 3.12 00/72] 3.12.67-stable review Jiri Slaby <jslaby@suse.cz> - 2016-11-10 20:00 +0100

csiph-web