aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/pcmcia
diff options
context:
space:
mode:
authorDominik Brodowski <linux@dominikbrodowski.net>2010-08-03 03:33:45 -0400
committerDominik Brodowski <linux@dominikbrodowski.net>2010-08-03 10:43:13 -0400
commit127c03cdbad9bd5af5d7f33bd31a1015a90cb77f (patch)
treea948c5814a7d2e82801927bc3d5f06d3d7056ab0 /drivers/pcmcia
parent0f52e86ded65749c6037473013ad77b2afa4f68d (diff)
pcmcia: avoid buffer overflow in pcmcia_setup_isa_irq
NR_IRQS may be as low as 16, causing a (harmless?) buffer overflow in pcmcia_setup_isa_irq(): static u8 pcmcia_used_irq[NR_IRQS]; ... if ((try < 32) && pcmcia_used_irq[irq]) continue; This is read-only, so if this address would be non-zero, it would just mean we would not attempt an IRQ >= NR_IRQS -- which would fail anyway! And as request_irq() fails for an irq >= NR_IRQS, the setting code path: pcmcia_used_irq[irq]++; is never reached as well. Reported-by: Christoph Fritz <chf.fritz@googlemail.com> CC: stable@kernel.org Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net> Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
Diffstat (limited to 'drivers/pcmcia')
-rw-r--r--drivers/pcmcia/pcmcia_resource.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index d48437f83acf..54aa1c238cb3 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -677,7 +677,7 @@ EXPORT_SYMBOL(__pcmcia_request_exclusive_irq);
677#ifdef CONFIG_PCMCIA_PROBE 677#ifdef CONFIG_PCMCIA_PROBE
678 678
679/* mask of IRQs already reserved by other cards, we should avoid using them */ 679/* mask of IRQs already reserved by other cards, we should avoid using them */
680static u8 pcmcia_used_irq[NR_IRQS]; 680static u8 pcmcia_used_irq[32];
681 681
682static irqreturn_t test_action(int cpl, void *dev_id) 682static irqreturn_t test_action(int cpl, void *dev_id)
683{ 683{
@@ -700,6 +700,9 @@ static int pcmcia_setup_isa_irq(struct pcmcia_device *p_dev, int type)
700 for (try = 0; try < 64; try++) { 700 for (try = 0; try < 64; try++) {
701 irq = try % 32; 701 irq = try % 32;
702 702
703 if (irq > NR_IRQS)
704 continue;
705
703 /* marked as available by driver, not blocked by userspace? */ 706 /* marked as available by driver, not blocked by userspace? */
704 if (!((mask >> irq) & 1)) 707 if (!((mask >> irq) & 1))
705 continue; 708 continue;