diff options
| author | Levi Yun <ppbuk5246@gmail.com> | 2024-05-06 05:10:59 +0100 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2024-05-08 11:19:43 +0200 |
| commit | d7ad05c86e2191bd66e5b62fca8da53c4a53484f (patch) | |
| tree | 059c0c94610cd072eaf552d1b3f845f8e4238abe /kernel/time | |
| parent | dd5a440a31fae6e459c0d6271dddd62825505361 (diff) | |
timers/migration: Prevent out of bounds access on failure
When tmigr_setup_groups() fails the level 0 group allocation, then the
cleanup derefences index -1 of the local stack array.
Prevent this by checking the loop condition first.
Fixes: 7ee988770326 ("timers: Implement the hierarchical pull model")
Signed-off-by: Levi Yun <ppbuk5246@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Anna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/r/20240506041059.86877-1-ppbuk5246@gmail.com
Diffstat (limited to 'kernel/time')
| -rw-r--r-- | kernel/time/timer_migration.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/kernel/time/timer_migration.c b/kernel/time/timer_migration.c index ccba875d2234..84413114db5c 100644 --- a/kernel/time/timer_migration.c +++ b/kernel/time/timer_migration.c @@ -1596,7 +1596,7 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node) } while (i < tmigr_hierarchy_levels); - do { + while (i > 0) { group = stack[--i]; if (err < 0) { @@ -1645,7 +1645,7 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node) tmigr_connect_child_parent(child, group); } } - } while (i > 0); + } kfree(stack); |