lkml.org 
[lkml]   [2010]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[39/59] pcmcia: avoid buffer overflow in pcmcia_setup_isa_irq
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Dominik Brodowski <linux@dominikbrodowski.net>

    commit 127c03cdbad9bd5af5d7f33bd31a1015a90cb77f upstream.

    NR_IRQS may be as low as 16, causing a (harmless?) buffer overflow in
    pcmcia_setup_isa_irq():

    static u8 pcmcia_used_irq[NR_IRQS];

    ...

    if ((try < 32) && pcmcia_used_irq[irq])
    continue;

    This is read-only, so if this address would be non-zero, it would just
    mean we would not attempt an IRQ >= NR_IRQS -- which would fail anyway!
    And as request_irq() fails for an irq >= NR_IRQS, the setting code path:

    pcmcia_used_irq[irq]++;

    is never reached as well.

    Reported-by: Christoph Fritz <chf.fritz@googlemail.com>
    Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
    Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/pcmcia/pcmcia_resource.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    --- a/drivers/pcmcia/pcmcia_resource.c
    +++ b/drivers/pcmcia/pcmcia_resource.c
    @@ -39,7 +39,7 @@ module_param(io_speed, int, 0444);
    #ifdef CONFIG_PCMCIA_PROBE
    #include <asm/irq.h>
    /* mask of IRQs already reserved by other cards, we should avoid using them */
    -static u8 pcmcia_used_irq[NR_IRQS];
    +static u8 pcmcia_used_irq[32];
    #endif


    @@ -719,6 +719,9 @@ int pcmcia_request_irq(struct pcmcia_dev
    for (try = 0; try < 64; try++) {
    irq = try % 32;

    + if (irq > NR_IRQS)
    + continue;
    +
    /* marked as available by driver, and not blocked by userspace? */
    if (!((mask >> irq) & 1))
    continue;



    \
     
     \ /
      Last update: 2010-08-25 01:45    [W:0.019 / U:30.544 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site