From 4c5cc1feaa288924aea08ebf1d2a27b064db9e6d Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] APEI / ERST: Fix missing error handling in erst_reader()
Date: Thu, 14 Dec 2017 13:31:16 +0100
Message-id: <20171214123116.929-1-tiwai@suse.de>
Patch-mainline: Submitted, linux-acpi ML
References: bsc#1072556

The commit f6f828513290 ("pstore: pass allocated memory region back to
caller") changed the check of the return value from erst_read() in
erst_reader() in the following way:

        if (len == -ENOENT)
                goto skip;
-       else if (len < 0) {
-               rc = -1;
+       else if (len < sizeof(*rcd)) {
+               rc = -EIO;
                goto out;

This introduced another bug: since the comparison with sizeof() is
cast to unsigned, a negative len value doesn't hit any longer.
As a result, when an error is returned from erst_read(), the code
falls through, and it may eventually lead to some weird thing like
memory corruption.

This patch adds the negative error value check more explicitly for
addressing the issue.

Fixes: f6f828513290 ("pstore: pass allocated memory region back to caller")
Cc: <stable@vger.kernel.org>
Tested-by: Jerry Tang <jtang@suse.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

---
 drivers/acpi/apei/erst.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -1007,7 +1007,7 @@ skip:
 	/* The record may be cleared by others, try read next record */
 	if (len == -ENOENT)
 		goto skip;
-	else if (len < sizeof(*rcd)) {
+	else if (len < 0 || len < sizeof(*rcd)) {
 		rc = -EIO;
 		goto out;
 	}