lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.5 416/542] ide: serverworks: potential overflow in svwks_set_pio_mode()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit ce1f31b4c0b9551dd51874dd5364654ed4ca13ae ]

    The "drive->dn" variable is a u8 controlled by root.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/ide/serverworks.c | 6 ++++++
    1 file changed, 6 insertions(+)

    diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
    index ac6fc3fffa0de..458e72e034b09 100644
    --- a/drivers/ide/serverworks.c
    +++ b/drivers/ide/serverworks.c
    @@ -115,6 +115,9 @@ static void svwks_set_pio_mode(ide_hwif_t *hwif, ide_drive_t *drive)
    struct pci_dev *dev = to_pci_dev(hwif->dev);
    const u8 pio = drive->pio_mode - XFER_PIO_0;

    + if (drive->dn >= ARRAY_SIZE(drive_pci))
    + return;
    +
    pci_write_config_byte(dev, drive_pci[drive->dn], pio_modes[pio]);

    if (svwks_csb_check(dev)) {
    @@ -141,6 +144,9 @@ static void svwks_set_dma_mode(ide_hwif_t *hwif, ide_drive_t *drive)

    u8 ultra_enable = 0, ultra_timing = 0, dma_timing = 0;

    + if (drive->dn >= ARRAY_SIZE(drive_pci2))
    + return;
    +
    pci_read_config_byte(dev, (0x56|hwif->channel), &ultra_timing);
    pci_read_config_byte(dev, 0x54, &ultra_enable);

    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 18:55    [W:2.423 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site