| From foo@baz Mon Sep 17 12:33:31 CEST 2018 |
| From: Anton Vasilyev <vasilyev@ispras.ru> |
| Date: Fri, 27 Jul 2018 16:39:31 +0300 |
| Subject: tty: rocket: Fix possible buffer overwrite on register_PCI |
| |
| From: Anton Vasilyev <vasilyev@ispras.ru> |
| |
| [ Upstream commit 0419056ec8fd01ddf5460d2dba0491aad22657dd ] |
| |
| If number of isa and pci boards exceed NUM_BOARDS on the path |
| rp_init()->init_PCI()->register_PCI() then buffer overwrite occurs |
| in register_PCI() on assign rcktpt_io_addr[i]. |
| |
| The patch adds check on upper bound for index of registered |
| board in register_PCI. |
| |
| Found by Linux Driver Verification project (linuxtesting.org). |
| |
| Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/tty/rocket.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/tty/rocket.c |
| +++ b/drivers/tty/rocket.c |
| @@ -1894,7 +1894,7 @@ static __init int register_PCI(int i, st |
| ByteIO_t UPCIRingInd = 0; |
| |
| if (!dev || !pci_match_id(rocket_pci_ids, dev) || |
| - pci_enable_device(dev)) |
| + pci_enable_device(dev) || i >= NUM_BOARDS) |
| return 0; |
| |
| rcktpt_io_addr[i] = pci_resource_start(dev, 0); |
