From: John Garry john.garry@huawei.com
mainline inclusion from mainline-v5.11-rc5 commit e1dc20995cb9fa04b46e8f37113a7203c906d2bf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6LM81 CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
---------------------------------------------
The current check of nvec < minvec for nvec returned from platform_irq_count() will not detect a negative error code in nvec.
This is because minvec is unsigned, and, as such, nvec is promoted to unsigned in that check, which will make it a huge number (if it contained -EPROBE_DEFER).
In practice, an error should not occur in nvec for the only in-tree user, but add a check anyway.
Fixes: e15f2fa959f2 ("driver core: platform: Add devm_platform_get_irqs_affinity()") Reported-by: Dan Carpenter dan.carpenter@oracle.com Signed-off-by: John Garry john.garry@huawei.com Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/1608561055-231244-1-git-send-email-john.garry@huaw... Signed-off-by: Zhang Zekun zhangzekun11@huawei.com Reviewed-by: Weilong Chen chenweilong@huawei.com Signed-off-by: Jialin Zhang zhangjialin11@huawei.com --- drivers/base/platform.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/base/platform.c b/drivers/base/platform.c index ea8add164b89..74c97b65048c 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -351,6 +351,8 @@ int devm_platform_get_irqs_affinity(struct platform_device *dev, return -ERANGE;
nvec = platform_irq_count(dev); + if (nvec < 0) + return nvec;
if (nvec < minvec) return -ENOSPC;