From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755863AbYKTQfa (ORCPT ); Thu, 20 Nov 2008 11:35:30 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753519AbYKTQfW (ORCPT ); Thu, 20 Nov 2008 11:35:22 -0500 Received: from mx2.suse.de ([195.135.220.15]:37415 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753456AbYKTQfW (ORCPT ); Thu, 20 Nov 2008 11:35:22 -0500 Date: Thu, 20 Nov 2008 17:35:20 +0100 Message-ID: From: Takashi Iwai To: linux-kernel@vger.kernel.org Cc: Andrew Morton Subject: [PATCH] Fix array overflow in parport_serial.c User-Agent: Wanderlust/2.12.0 (Your Wildest Dreams) SEMI/1.14.6 (Maruoka) FLIM/1.14.7 (=?ISO-8859-4?Q?Sanj=F2?=) APEL/10.6 Emacs/22.3 (x86_64-suse-linux-gnu) MULE/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The netmos_9xx5_combo type assumes that PCI SSID provides always the correct value for the number of parallel and serial ports, but there are indeed broken devices with wrong numbers, which may result in Oops. This patch simply adds the check of the array range. Reference: Novell bnc#447067 https://bugzilla.novell.com/show_bug.cgi?id=447067 Signed-off-by: Takashi Iwai --- diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c index e2e95b3..101ed49 100644 --- a/drivers/parport/parport_serial.c +++ b/drivers/parport/parport_serial.c @@ -70,6 +70,8 @@ static int __devinit netmos_parallel_init(struct pci_dev *dev, struct parport_pc * parallel ports and is the number of serial ports. */ card->numports = (dev->subsystem_device & 0xf0) >> 4; + if (card->numports > ARRAY_SIZE(card->addr)) + card->numports = ARRAY_SIZE(card->addr); return 0; }