From: John Garry <john.garry@huawei.com> mainline inclusion from mainline-v5.11-rc5 commit e1dc20995cb9fa04b46e8f37113a7203c906d2bf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6LM81 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... --------------------------------------------- The current check of nvec < minvec for nvec returned from platform_irq_count() will not detect a negative error code in nvec. This is because minvec is unsigned, and, as such, nvec is promoted to unsigned in that check, which will make it a huge number (if it contained -EPROBE_DEFER). In practice, an error should not occur in nvec for the only in-tree user, but add a check anyway. Fixes: e15f2fa959f2 ("driver core: platform: Add devm_platform_get_irqs_affinity()") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: John Garry <john.garry@huawei.com> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/1608561055-231244-1-git-send-email-john.garry@huaw... Signed-off-by: Zhang Zekun <zhangzekun11@huawei.com> Reviewed-by: Weilong Chen <chenweilong@huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> --- drivers/base/platform.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/base/platform.c b/drivers/base/platform.c index ea8add164b89..74c97b65048c 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -351,6 +351,8 @@ int devm_platform_get_irqs_affinity(struct platform_device *dev, return -ERANGE; nvec = platform_irq_count(dev); + if (nvec < 0) + return nvec; if (nvec < minvec) return -ENOSPC; -- 2.25.1