| commit | e9237ad37ea237e7d84581d72650d69701559f65 | |
| author | Dominik Brodowski <linux@dominikbrodowski.net> | |
| Tue, 3 Aug 2010 07:33:45 +0000 (3 09:33 +0200) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Thu, 26 Aug 2010 23:43:50 +0000 (26 16:43 -0700) | ||
| tree | 6f8746104bb88eceb4e495763e0ae08190e8fb92 | treesnapshot (tar.gz zip) |
| parent | 72a85b3b5ae9508964df640f005110dfbcfe1f19 | commitdiff |
pcmcia: avoid buffer overflow in pcmcia_setup_isa_irq
commit 127c03cdbad9bd5af5d7f33bd31a1015a90cb77f upstream.
NR_IRQS may be as low as 16, causing a (harmless?) buffer overflow in
pcmcia_setup_isa_irq():
static u8 pcmcia_used_irq[NR_IRQS];
...
if ((try < 32) && pcmcia_used_irq[irq])
continue;
This is read-only, so if this address would be non-zero, it would just
mean we would not attempt an IRQ >= NR_IRQS -- which would fail anyway!
And as request_irq() fails for an irq >= NR_IRQS, the setting code path:
pcmcia_used_irq[irq]++;
is never reached as well.
Reported-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 127c03cdbad9bd5af5d7f33bd31a1015a90cb77f upstream.
NR_IRQS may be as low as 16, causing a (harmless?) buffer overflow in
pcmcia_setup_isa_irq():
static u8 pcmcia_used_irq[NR_IRQS];
...
if ((try < 32) && pcmcia_used_irq[irq])
continue;
This is read-only, so if this address would be non-zero, it would just
mean we would not attempt an IRQ >= NR_IRQS -- which would fail anyway!
And as request_irq() fails for an irq >= NR_IRQS, the setting code path:
pcmcia_used_irq[irq]++;
is never reached as well.
Reported-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| drivers/pcmcia/pcmcia_resource.c | diffblobblamehistory |