lkml.org 
[lkml]   [2020]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 55/86] staging: comedi: verify array index is correct before using it
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit ef75e14a6c935eec82abac07ab68e388514e39bc ]

    This code reads from the array before verifying that "trig" is a valid
    index. If the index is wildly out of bounds then reading from an
    invalid address could lead to an Oops.

    Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
    Link: https://lore.kernel.org/r/20200709102936.GA20875@mwanda
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++++++---
    1 file changed, 7 insertions(+), 3 deletions(-)

    diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
    index 63991c49ff230..79a8799b12628 100644
    --- a/drivers/staging/comedi/drivers/addi_apci_1500.c
    +++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
    @@ -465,9 +465,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
    unsigned int lo_mask = data[5] << shift;
    unsigned int chan_mask = hi_mask | lo_mask;
    unsigned int old_mask = (1 << shift) - 1;
    - unsigned int pm = devpriv->pm[trig] & old_mask;
    - unsigned int pt = devpriv->pt[trig] & old_mask;
    - unsigned int pp = devpriv->pp[trig] & old_mask;
    + unsigned int pm;
    + unsigned int pt;
    + unsigned int pp;

    if (trig > 1) {
    dev_dbg(dev->class_dev,
    @@ -480,6 +480,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
    return -EINVAL;
    }

    + pm = devpriv->pm[trig] & old_mask;
    + pt = devpriv->pt[trig] & old_mask;
    + pp = devpriv->pp[trig] & old_mask;
    +
    switch (data[2]) {
    case COMEDI_DIGITAL_TRIG_DISABLE:
    /* clear trigger configuration */
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-07-20 17:42    [W:6.622 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site