uio: fix allocating minor id for uio device

The number of uio devices that could be used should be less than
UIO_MAX_DEVICES by design, and this work guards any cases in which id
more than UIO_MAX_DEVICES is utilized.

Signed-off-by: Hillf Danton <dhillf@gmail.com>
Signed-off-by: Hans J. Koch <hjk@hansjkoch.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 7 insertions, 1 deletions

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 10a029b24159..d2efe823c20d 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -381,7 +381,13 @@ static int uio_get_minor(struct uio_device *idev)
                         retval = -ENOMEM;
                 goto exit;
         }
-        idev->minor = id & MAX_ID_MASK;
+        if (id < UIO_MAX_DEVICES) {
+                idev->minor = id;
+        } else {
+                dev_err(idev->dev, "too many uio devices\n");
+                retval = -EINVAL;
+                idr_remove(&uio_idr, id);
+        }
 exit:
         mutex_unlock(&minor_lock);
         return retval;