Messages in this thread | | | Date | Mon, 4 Feb 2013 19:15:15 +0100 | From | Stefan Richter <> | Subject | Re: [PATCH 12.5/62] firewire: add minor number range check to fw_device_init() |
| |
On Feb 04 Tejun Heo wrote: > fw_device_init() didn't check whether the allocated minor number isn't > too large. Fail if it goes overflows MINORBITS. > > Signed-off-by: Tejun Heo <tj@kernel.org> > Suggested-by: Stefan Richter <stefanr@s5r6.in-berlin.de> > Cc: stable@vger.kernel.org > --- > drivers/firewire/core-device.c | 4 ++++ > 1 file changed, 4 insertions(+) > > --- a/drivers/firewire/core-device.c > +++ b/drivers/firewire/core-device.c > @@ -1020,6 +1020,10 @@ static void fw_device_init(struct work_s > ret = idr_pre_get(&fw_device_idr, GFP_KERNEL) ? > idr_get_new(&fw_device_idr, device, &minor) : > -ENOMEM; > + if (minor >= 1 << MINORBITS) { > + idr_remove(&fw_device_idr, minor); > + minor = -ENOSPC; > + } > up_write(&fw_device_rwsem); > > if (ret < 0)
Thanks; routing together with the other idr patches through mm Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Not totally sure whether to bother -stable with this, as this condition is rather difficult to provoke. But since the fix is small and "obvious", why not. -- Stefan Richter -=====-===-= --=- --=-- http://arcgraph.de/sr/
| |