Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

driver core: platform: Prevent resouce overflow from causing infinite loops

num_resources in the platform_device struct is declared as a u32. The
for loops that iterate over num_resources use an int as the counter,
which can cause infinite loops on architectures with smaller ints.
Change the loop counters to u32.

Signed-off-by: Simon Schwartz <kern.simon@theschwartz.xyz>
Link: https://lore.kernel.org/r/2201ce63a2a171ffd2ed14e867875316efcf71db.camel@theschwartz.xyz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Simon Schwartz and committed by
Greg Kroah-Hartman
39cc539f 5bf33f04

+6 -4
+6 -4
drivers/base/platform.c
··· 27 27 #include <linux/limits.h> 28 28 #include <linux/property.h> 29 29 #include <linux/kmemleak.h> 30 + #include <linux/types.h> 30 31 31 32 #include "base.h" 32 33 #include "power/power.h" ··· 49 48 struct resource *platform_get_resource(struct platform_device *dev, 50 49 unsigned int type, unsigned int num) 51 50 { 52 - int i; 51 + u32 i; 53 52 54 53 for (i = 0; i < dev->num_resources; i++) { 55 54 struct resource *r = &dev->resource[i]; ··· 256 255 unsigned int type, 257 256 const char *name) 258 257 { 259 - int i; 258 + u32 i; 260 259 261 260 for (i = 0; i < dev->num_resources; i++) { 262 261 struct resource *r = &dev->resource[i]; ··· 502 501 */ 503 502 int platform_device_add(struct platform_device *pdev) 504 503 { 505 - int i, ret; 504 + u32 i; 505 + int ret; 506 506 507 507 if (!pdev) 508 508 return -EINVAL; ··· 592 590 */ 593 591 void platform_device_del(struct platform_device *pdev) 594 592 { 595 - int i; 593 + u32 i; 596 594 597 595 if (!IS_ERR_OR_NULL(pdev)) { 598 596 device_del(&pdev->dev);