| From 3f1f08fc52b7fa8a6f80bfd88a6d75de53d389d8 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 21 May 2021 20:06:17 +0800 |
| Subject: char: pcmcia: error out if 'num_bytes_read' is greater than 4 in |
| set_protocol() |
| |
| From: Yu Kuai <yukuai3@huawei.com> |
| |
| [ Upstream commit 37188559c610f1b7eec83c8e448936c361c578de ] |
| |
| Theoretically, it will cause index out of bounds error if |
| 'num_bytes_read' is greater than 4. As we expect it(and was tested) |
| never to be greater than 4, error out if it happens. |
| |
| Fixes: c1986ee9bea3 ("[PATCH] New Omnikey Cardman 4000 driver") |
| Signed-off-by: Yu Kuai <yukuai3@huawei.com> |
| Link: https://lore.kernel.org/r/20210521120617.138396-1-yukuai3@huawei.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/char/pcmcia/cm4000_cs.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c |
| index 89681f07bc78..9468e9520cee 100644 |
| --- a/drivers/char/pcmcia/cm4000_cs.c |
| +++ b/drivers/char/pcmcia/cm4000_cs.c |
| @@ -544,6 +544,10 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) |
| io_read_num_rec_bytes(iobase, &num_bytes_read); |
| if (num_bytes_read >= 4) { |
| DEBUGP(2, dev, "NumRecBytes = %i\n", num_bytes_read); |
| + if (num_bytes_read > 4) { |
| + rc = -EIO; |
| + goto exit_setprotocol; |
| + } |
| break; |
| } |
| usleep_range(10000, 11000); |
| -- |
| 2.30.2 |
| |