| From c10e9aa59a8ad14f3a8a543d35cfdf10bbce2287 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 7 Aug 2018 13:59:05 +0300 |
| Subject: serial: mxs-auart: Fix potential infinite loop |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Anton Vasilyev <vasilyev@ispras.ru> |
| |
| [ Upstream commit 5963e8a3122471cadfe0eba41c4ceaeaa5c8bb4d ] |
| |
| On the error path of mxs_auart_request_gpio_irq() is performed |
| backward iterating with index i of enum type. Underline enum type |
| may be unsigned char. In this case check (--i >= 0) will be always |
| true and error handling goes into infinite loop. |
| |
| The patch changes the check so that it is valid for signed and unsigned |
| types. |
| |
| Found by Linux Driver Verification project (linuxtesting.org). |
| |
| Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru> |
| Acked-by: Uwe Kleine-Kรถnig <u.kleine-koenig@pengutronix.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/tty/serial/mxs-auart.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c |
| index 34acdf29713d7..4c188f4079b3e 100644 |
| --- a/drivers/tty/serial/mxs-auart.c |
| +++ b/drivers/tty/serial/mxs-auart.c |
| @@ -1634,8 +1634,9 @@ static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s) |
| |
| /* |
| * If something went wrong, rollback. |
| + * Be careful: i may be unsigned. |
| */ |
| - while (err && (--i >= 0)) |
| + while (err && (i-- > 0)) |
| if (irq[i] >= 0) |
| free_irq(irq[i], s); |
| |
| -- |
| 2.20.1 |
| |
