aboutsummaryrefslogtreecommitdiffstats
path: root/arch/sparc
diff options
context:
space:
mode:
authorRobert Reif <reif@earthlink.net>2008-12-26 18:39:11 -0500
committerDavid S. Miller <davem@davemloft.net>2008-12-26 18:39:11 -0500
commit92d9091f305cc32eb64edc1757d925b93acde6da (patch)
treeeddeec33e27e3eb5d5cf11c0c0e521c0305ea186 /arch/sparc
parente6b04fe0bae3c0c9204c8190c8988efa6646ef35 (diff)
sparc: fix array overrun check in of_device_64.c
Do the array length check and fixup before copying the array. Signed-off-by: Robert Reif <reif@earthlink.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'arch/sparc')
-rw-r--r--arch/sparc/kernel/of_device_64.c18
1 files changed, 9 insertions, 9 deletions
diff --git a/arch/sparc/kernel/of_device_64.c b/arch/sparc/kernel/of_device_64.c
index 0f616ae3246c..46e231f7c5ce 100644
--- a/arch/sparc/kernel/of_device_64.c
+++ b/arch/sparc/kernel/of_device_64.c
@@ -811,20 +811,20 @@ static struct of_device * __init scan_one_device(struct device_node *dp,
811 811
812 irq = of_get_property(dp, "interrupts", &len); 812 irq = of_get_property(dp, "interrupts", &len);
813 if (irq) { 813 if (irq) {
814 memcpy(op->irqs, irq, len);
815 op->num_irqs = len / 4; 814 op->num_irqs = len / 4;
815
816 /* Prevent overrunning the op->irqs[] array. */
817 if (op->num_irqs > PROMINTR_MAX) {
818 printk(KERN_WARNING "%s: Too many irqs (%d), "
819 "limiting to %d.\n",
820 dp->full_name, op->num_irqs, PROMINTR_MAX);
821 op->num_irqs = PROMINTR_MAX;
822 }
823 memcpy(op->irqs, irq, op->num_irqs * 4);
816 } else { 824 } else {
817 op->num_irqs = 0; 825 op->num_irqs = 0;
818 } 826 }
819 827
820 /* Prevent overrunning the op->irqs[] array. */
821 if (op->num_irqs > PROMINTR_MAX) {
822 printk(KERN_WARNING "%s: Too many irqs (%d), "
823 "limiting to %d.\n",
824 dp->full_name, op->num_irqs, PROMINTR_MAX);
825 op->num_irqs = PROMINTR_MAX;
826 }
827
828 build_device_resources(op, parent); 828 build_device_resources(op, parent);
829 for (i = 0; i < op->num_irqs; i++) 829 for (i = 0; i < op->num_irqs; i++)
830 op->irqs[i] = build_one_device_irq(op, parent, op->irqs[i]); 830 op->irqs[i] = build_one_device_irq(op, parent, op->irqs[i]);