Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit d39d5ed97e2b8e089f85ffaf5909768d83147be0

Authored by Karsten Keil
Committed by Linus Torvalds
1 parent e46dc1dab9
Exists in master and in 20 other branches dlt-processor-sdk-linux-03.00.00.04, newt-ti-linux-3.12.y, processor-sdk-linux-01.00.00, processor-sdk-linux-02.00.01, smarc-ti-linux-3.12.10, smarc-ti-linux-3.12.y, smarc-ti-linux-3.14.y, smarc-ti-linux-3.15.y, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04, ti-linux-3.12.y, ti-linux-3.14.y, ti-linux-3.15.y, ti-lsk-linux-4.1.y

ISDN: Fix data access out of array bounds 

Fix against access random data bytes outside the dev->chanmap array.
Thanks to Oliver Neukum for pointing me to this issue.

Signed-off-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 3 additions and 2 deletions Side-by-side Diff

drivers/isdn/i4l/isdn_common.c
Diff comments   View file @ d39d5ed
... ... @@ -1135,7 +1135,7 @@
1135 1135 if (count > dev->drv[drvidx]->stavail)
1136 1136 count = dev->drv[drvidx]->stavail;
1137 1137 len = dev->drv[drvidx]->interface->readstat(buf, count,
1138   - drvidx, isdn_minor2chan(minor));
  1138 + drvidx, isdn_minor2chan(minor - ISDN_MINOR_CTRL));
1139 1139 if (len < 0) {
1140 1140 retval = len;
1141 1141 goto out;
... ... @@ -1207,7 +1207,8 @@
1207 1207 */
1208 1208 if (dev->drv[drvidx]->interface->writecmd)
1209 1209 retval = dev->drv[drvidx]->interface->
1210   - writecmd(buf, count, drvidx, isdn_minor2chan(minor));
  1210 + writecmd(buf, count, drvidx,
  1211 + isdn_minor2chan(minor - ISDN_MINOR_CTRL));
1211 1212 else
1212 1213 retval = count;
1213 1214 goto out;