summaryrefslogtreecommitdiffstats
path: root/block/partitions/efi.c
diff options
context:
space:
mode:
authorAntti P Miettinen2013-11-21 23:32:05 +0100
committerLinus Torvalds2013-11-22 01:42:27 +0100
commit49204c116a9ee24536d371be02a2f05e6493c949 (patch)
treef212b1a3d8b8fef05f570658f6acd9efe596ad26 /block/partitions/efi.c
parentARM: drivers/rtc/rtc-at91rm9200.c: disable interrupts at shutdown (diff)
downloadkernel-qcow2-linux-49204c116a9ee24536d371be02a2f05e6493c949.tar.gz
kernel-qcow2-linux-49204c116a9ee24536d371be02a2f05e6493c949.tar.xz
kernel-qcow2-linux-49204c116a9ee24536d371be02a2f05e6493c949.zip
block/partitions/efi.c: fix bound check
Use ARRAY_SIZE instead of sizeof to get proper max for label length. Since this is just a read out of bounds it's not that bad, but the problem becomes user-visible eg if one tries to use DEBUG_PAGEALLOC and DEBUG_RODATA, at least with some enhancements from Hiroshi. Of course the destination array can contain garbage when we read beyond the end of source array so that would be another user-visible problem. Signed-off-by: Antti P Miettinen <amiettinen@nvidia.com> Reviewed-by: Hiroshi Doyu <hdoyu@nvidia.com> Tested-by: Hiroshi Doyu <hdoyu@nvidia.com> Cc: Will Drewry <wad@chromium.org> Cc: Matt Fleming <matt.fleming@intel.com> Acked-by: Davidlohr Bueso <davidlohr@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'block/partitions/efi.c')
-rw-r--r--block/partitions/efi.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/block/partitions/efi.c b/block/partitions/efi.c
index a8287b49d062..dc51f467a560 100644
--- a/block/partitions/efi.c
+++ b/block/partitions/efi.c
@@ -96,6 +96,7 @@
* - Code works, detects all the partitions.
*
************************************************************/
+#include <linux/kernel.h>
#include <linux/crc32.h>
#include <linux/ctype.h>
#include <linux/math64.h>
@@ -715,8 +716,8 @@ int efi_partition(struct parsed_partitions *state)
efi_guid_unparse(&ptes[i].unique_partition_guid, info->uuid);
/* Naively convert UTF16-LE to 7 bits. */
- label_max = min(sizeof(info->volname) - 1,
- sizeof(ptes[i].partition_name));
+ label_max = min(ARRAY_SIZE(info->volname) - 1,
+ ARRAY_SIZE(ptes[i].partition_name));
info->volname[label_max] = 0;
while (label_count < label_max) {
u8 c = ptes[i].partition_name[label_count] & 0xff;