From f5ec25deb2471bd49e907ab2f9ef6f860eb7cf95 Mon Sep 17 00:00:00 2001 From: Chen Gong Date: Mon, 16 May 2011 11:01:39 -0700 Subject: [PATCH] pstore: fix potential logic issue in pstore read interface 1) in the calling of erst_read, the parameter of buffer size maybe overflows and cause crash 2) the return value of erst_read should be checked more strictly Signed-off-by: Chen Gong Signed-off-by: Tony Luck --- drivers/acpi/apei/erst.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c index ddb68c4f8d3e..e6cef8e1b534 100644 --- a/drivers/acpi/apei/erst.c +++ b/drivers/acpi/apei/erst.c @@ -1006,7 +1006,14 @@ static ssize_t erst_reader(u64 *id, enum pstore_type_id *type, } len = erst_read(record_id, &rcd->hdr, sizeof(*rcd) + - erst_erange.size); + erst_info.bufsize); + /* The record may be cleared by others, try read next record */ + if (len == -ENOENT) + goto skip; + else if (len < 0) { + rc = -1; + goto out; + } if (uuid_le_cmp(rcd->hdr.creator_id, CPER_CREATOR_PSTORE) != 0) goto skip;