1 files changed, 17 insertions, 4 deletions

diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index a13f53486114..b4cdd690ae71 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -43,18 +43,32 @@ store_new_id(struct device_driver *driver, const char *buf, size_t count)
 {
         struct pci_dynid *dynid;
         struct pci_driver *pdrv = to_pci_driver(driver);
+        const struct pci_device_id *ids = pdrv->id_table;
         __u32 vendor, device, subvendor=PCI_ANY_ID,
                 subdevice=PCI_ANY_ID, class=0, class_mask=0;
         unsigned long driver_data=0;
         int fields=0;
-        int retval = 0;
+        int retval;
 
-        fields = sscanf(buf, "%x %x %x %x %x %x %lux",
+        fields = sscanf(buf, "%x %x %x %x %x %x %lx",
                         &vendor, &device, &subvendor, &subdevice,
                         &class, &class_mask, &driver_data);
         if (fields < 2)
                 return -EINVAL;
 
+        /* Only accept driver_data values that match an existing id_table
+           entry */
+        retval = -EINVAL;
+        while (ids->vendor || ids->subvendor || ids->class_mask) {
+                if (driver_data == ids->driver_data) {
+                        retval = 0;
+                        break;
+                }
+                ids++;
+        }
+        if (retval)     /* No match */
+                return retval;
+
         dynid = kzalloc(sizeof(*dynid), GFP_KERNEL);
         if (!dynid)
                 return -ENOMEM;
@@ -65,8 +79,7 @@ store_new_id(struct device_driver *driver, const char *buf, size_t count)
         dynid->id.subdevice = subdevice;
         dynid->id.class = class;
         dynid->id.class_mask = class_mask;
-        dynid->id.driver_data = pdrv->dynids.use_driver_data ?
-                driver_data : 0UL;
+        dynid->id.driver_data = driver_data;
 
         spin_lock(&pdrv->dynids.lock);
         list_add_tail(&dynid->node, &pdrv->dynids.list);