From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935151AbaBDWXT (ORCPT ); Tue, 4 Feb 2014 17:23:19 -0500 Received: from cpsmtpb-ews06.kpnxchange.com ([213.75.39.9]:57086 "EHLO cpsmtpb-ews06.kpnxchange.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932941AbaBDWXN (ORCPT ); Tue, 4 Feb 2014 17:23:13 -0500 Message-ID: <1391552592.13156.15.camel@x220> Subject: [PATCH 1/2] raw: test against runtime value of max_raw_minors From: Paul Bolle To: Arnd Bergmann , Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org Date: Tue, 04 Feb 2014 23:23:12 +0100 Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.3 (3.10.3-1.fc20) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 04 Feb 2014 22:23:12.0728 (UTC) FILETIME=[B1009D80:01CF21F7] X-RcptDomain: vger.kernel.org Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org bind_get() checks the device number it is called with. It uses MAX_RAW_MINORS for the upper bound. But MAX_RAW_MINORS is set at compile time while the actual number of raw devices can be set at runtime. This means the test can either be too strict or too lenient. And if the test ends up being too lenient bind_get() might try to access memory beyond what was allocated for "raw_devices". So check against the runtime value (max_raw_minors) in this function. Signed-off-by: Paul Bolle --- drivers/char/raw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/raw.c b/drivers/char/raw.c index f3223aa..6e8d65e 100644 --- a/drivers/char/raw.c +++ b/drivers/char/raw.c @@ -190,7 +190,7 @@ static int bind_get(int number, dev_t *dev) struct raw_device_data *rawdev; struct block_device *bdev; - if (number <= 0 || number >= MAX_RAW_MINORS) + if (number <= 0 || number >= max_raw_minors) return -EINVAL; rawdev = &raw_devices[number]; -- 1.8.5.3