From 329d416ca0ecc38c2be2515897d0e0e8780af1ce Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Sun, 26 Jun 2016 22:26:11 -0700 Subject: [PATCH] lkdtm: remove intentional off-by-one array access There wasn't a good reason for keeping the enum and the names out of sync by 1 position just to avoid "NONE" and "INVALID" from being in the string lists. Signed-off-by: Kees Cook --- drivers/misc/lkdtm_core.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c index e0f10131511f..4f9d2f32c88b 100644 --- a/drivers/misc/lkdtm_core.c +++ b/drivers/misc/lkdtm_core.c @@ -111,6 +111,7 @@ enum ctype { }; static char* cp_name[] = { + "INVALID", "INT_HARDWARE_ENTRY", "INT_HW_IRQ_EN", "INT_TASKLET_ENTRY", @@ -123,6 +124,7 @@ static char* cp_name[] = { }; static char* cp_type[] = { + "NONE", "PANIC", "BUG", "WARNING", @@ -257,7 +259,7 @@ static enum ctype parse_cp_type(const char *what, size_t count) for (i = 0; i < ARRAY_SIZE(cp_type); i++) { if (!strcmp(what, cp_type[i])) - return i + 1; + return i; } return CT_NONE; @@ -266,9 +268,9 @@ static enum ctype parse_cp_type(const char *what, size_t count) static const char *cp_type_to_str(enum ctype type) { if (type == CT_NONE || type < 0 || type > ARRAY_SIZE(cp_type)) - return "None"; + return "NONE"; - return cp_type[type - 1]; + return cp_type[type]; } static const char *cp_name_to_str(enum cname name) @@ -276,7 +278,7 @@ static const char *cp_name_to_str(enum cname name) if (name == CN_INVALID || name < 0 || name > ARRAY_SIZE(cp_name)) return "INVALID"; - return cp_name[name - 1]; + return cp_name[name]; } @@ -304,9 +306,13 @@ static int lkdtm_parse_commandline(void) if (cptype == CT_NONE) return -EINVAL; + /* Refuse INVALID as a selectable crashpoint name. */ + if (!strcmp(cpoint_name, "INVALID")) + return -EINVAL; + for (i = 0; i < ARRAY_SIZE(cp_name); i++) { if (!strcmp(cpoint_name, cp_name[i])) { - cpoint = i + 1; + cpoint = i; return 0; } } -- 2.20.1