diff options
| author | Liu ShuoX <shuox.liu@intel.com> | 2014-03-12 21:24:44 +0800 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-11 10:58:41 +0200 |
| commit | c3d0c989ac741271fba94cfd0b3aadc72fe3717d (patch) | |
| tree | 172325b5982c4111cd0ccbb37800a6d9382ad5be | |
| parent | e45e41f41160c6eebb5c3b1544b87d323b02426f (diff) | |
pstore: Fix buffer overflow while write offset equal to buffer size
commit 017321cf390045dd4c4afc4a232995ea50bcf66d upstream.
In case new offset is equal to prz->buffer_size, it won't wrap at this
time and will return old(overflow) value next time.
Signed-off-by: Liu ShuoX <shuox.liu@intel.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
| -rw-r--r-- | fs/pstore/ram_core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index bda61a759..0b367ef7a 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -54,7 +54,7 @@ static size_t buffer_start_add_atomic(struct persistent_ram_zone *prz, size_t a) do { old = atomic_read(&prz->buffer->start); new = old + a; - while (unlikely(new > prz->buffer_size)) + while (unlikely(new >= prz->buffer_size)) new -= prz->buffer_size; } while (atomic_cmpxchg(&prz->buffer->start, old, new) != old); @@ -91,7 +91,7 @@ static size_t buffer_start_add_locked(struct persistent_ram_zone *prz, size_t a) old = atomic_read(&prz->buffer->start); new = old + a; - while (unlikely(new > prz->buffer_size)) + while (unlikely(new >= prz->buffer_size)) new -= prz->buffer_size; atomic_set(&prz->buffer->start, new); |