of_device_get_modalias might return an error code, propagate that one. Otherwise the negative, signed integer is propagated to unsigned integer for the comparison resulting in a huge 'sl' size. Signed-off-by: Alexander Stein <alexander.stein@xxxxxxxxxxxxxxx> --- There is no problem if of_device_uevent_modalias uses the same checks as of_device_get_modalias, but this is error prone and cumbersome. drivers/of/device.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/of/device.c b/drivers/of/device.c index 5b929351b65bf..955bfb3d1a834 100644 --- a/drivers/of/device.c +++ b/drivers/of/device.c @@ -385,6 +385,8 @@ int of_device_uevent_modalias(const struct device *dev, struct kobj_uevent_env * sl = of_device_get_modalias(dev, &env->buf[env->buflen-1], sizeof(env->buf) - env->buflen); + if (sl < 0) + return sl; if (sl >= (sizeof(env->buf) - env->buflen)) return -ENOMEM; env->buflen += sl; -- 2.34.1
