diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2017-06-20 22:08:32 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2017-06-20 22:08:32 +0200 |
| commit | b50fb7c99217922ea36d6e38bae34d84c0587cad (patch) | |
| tree | 5f46167ac7fe5cd87bbed8ca8644f32befc5bbae /arch/x86/kernel/alternative.c | |
| parent | 04c848d398797a626608ff48804d809ae6687163 (diff) | |
| parent | 41f1830f5a7af77cf5c86359aba3cbd706687e52 (diff) | |
Merge branch 'linus' into irq/core
Get upstream changes so pending patches won't conflict.
Diffstat (limited to 'arch/x86/kernel/alternative.c')
| -rw-r--r-- | arch/x86/kernel/alternative.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c index c5b8f760473c..32e14d137416 100644 --- a/arch/x86/kernel/alternative.c +++ b/arch/x86/kernel/alternative.c @@ -409,8 +409,13 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start, memcpy(insnbuf, replacement, a->replacementlen); insnbuf_sz = a->replacementlen; - /* 0xe8 is a relative jump; fix the offset. */ - if (*insnbuf == 0xe8 && a->replacementlen == 5) { + /* + * 0xe8 is a relative jump; fix the offset. + * + * Instruction length is checked before the opcode to avoid + * accessing uninitialized bytes for zero-length replacements. + */ + if (a->replacementlen == 5 && *insnbuf == 0xe8) { *(s32 *)(insnbuf + 1) += replacement - instr; DPRINTK("Fix CALL offset: 0x%x, CALL 0x%lx", *(s32 *)(insnbuf + 1), |