diff options
Diffstat (limited to 'block/partitions')
| -rw-r--r-- | block/partitions/aix.c | 9 | ||||
| -rw-r--r-- | block/partitions/of.c | 5 |
2 files changed, 13 insertions, 1 deletions
diff --git a/block/partitions/aix.c b/block/partitions/aix.c index 85f4b967565e..cdcd60686e0b 100644 --- a/block/partitions/aix.c +++ b/block/partitions/aix.c @@ -228,6 +228,15 @@ int aix_partition(struct parsed_partitions *state) int next_lp_ix = 1; int lp_ix; + /* + * pvd was read into a fixed-size struct pvd whose ppe[] array + * holds ARRAY_SIZE(pvd->ppe) entries. pp_count is an + * unvalidated on-disk __be16, so clamp the scan to the array + * size to avoid walking past the allocation. + */ + if (numpps > ARRAY_SIZE(pvd->ppe)) + numpps = ARRAY_SIZE(pvd->ppe); + for (i = 0; i < numpps; i += 1) { struct ppe *p = pvd->ppe + i; unsigned int lv_ix; diff --git a/block/partitions/of.c b/block/partitions/of.c index 4e760fdffb3f..629f0fdbeb73 100644 --- a/block/partitions/of.c +++ b/block/partitions/of.c @@ -76,8 +76,10 @@ int of_partition(struct parsed_partitions *state) struct device_node *partitions_np = of_node_get(ddev->of_node); if (!partitions_np || - !of_device_is_compatible(partitions_np, "fixed-partitions")) + !of_device_is_compatible(partitions_np, "fixed-partitions")) { + of_node_put(partitions_np); return 0; + } slot = 1; /* Validate parition offset and size */ @@ -106,5 +108,6 @@ int of_partition(struct parsed_partitions *state) strlcat(state->pp_buf, "\n", PAGE_SIZE); + of_node_put(partitions_np); return 1; } |