lkml.org 
[lkml]   [2014]   [Feb]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.13 31/99] raw: test against runtime value of max_raw_minors
    Date
    3.13-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Paul Bolle <pebolle@tiscali.nl>

    commit 5bbb2ae3d6f896f8d2082d1eceb6131c2420b7cf upstream.

    bind_get() checks the device number it is called with. It uses
    MAX_RAW_MINORS for the upper bound. But MAX_RAW_MINORS is set at compile
    time while the actual number of raw devices can be set at runtime. This
    means the test can either be too strict or too lenient. And if the test
    ends up being too lenient bind_get() might try to access memory beyond
    what was allocated for "raw_devices".

    So check against the runtime value (max_raw_minors) in this function.

    Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
    Acked-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/char/raw.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/char/raw.c
    +++ b/drivers/char/raw.c
    @@ -190,7 +190,7 @@ static int bind_get(int number, dev_t *d
    struct raw_device_data *rawdev;
    struct block_device *bdev;

    - if (number <= 0 || number >= MAX_RAW_MINORS)
    + if (number <= 0 || number >= max_raw_minors)
    return -EINVAL;

    rawdev = &raw_devices[number];



    \
     
     \ /
      Last update: 2014-02-21 02:02    [W:4.030 / U:0.392 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site