diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2017-06-04 15:21:52 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2017-06-04 15:21:52 +0200 |
| commit | 978267b6430c07d62cb38f83e058a3132c52eca1 (patch) | |
| tree | 1a744c8230cd5a72adc363ca93458a748c664abe /arch/x86/kernel/alternative.c | |
| parent | 6bc51cbaa9d75c7c240282da5ff270815caccac0 (diff) | |
| parent | ff86bf0c65f14346bf2440534f9ba5ac232c39a0 (diff) | |
Merge branch 'timers/urgent' into WIP.timers
Pick up urgent fixes to avoid conflicts.
Diffstat (limited to 'arch/x86/kernel/alternative.c')
| -rw-r--r-- | arch/x86/kernel/alternative.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c index c5b8f760473c..32e14d137416 100644 --- a/arch/x86/kernel/alternative.c +++ b/arch/x86/kernel/alternative.c @@ -409,8 +409,13 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start, memcpy(insnbuf, replacement, a->replacementlen); insnbuf_sz = a->replacementlen; - /* 0xe8 is a relative jump; fix the offset. */ - if (*insnbuf == 0xe8 && a->replacementlen == 5) { + /* + * 0xe8 is a relative jump; fix the offset. + * + * Instruction length is checked before the opcode to avoid + * accessing uninitialized bytes for zero-length replacements. + */ + if (a->replacementlen == 5 && *insnbuf == 0xe8) { *(s32 *)(insnbuf + 1) += replacement - instr; DPRINTK("Fix CALL offset: 0x%x, CALL 0x%lx", *(s32 *)(insnbuf + 1), |