The "ni_at_a2150" driver determines the board type by calling `a2150_probe()`. This reads a register and converts it to a board index in the range 0 to 3. However, the board table array it indexes into (`a2150_boards[]`) only has 2 entries. Return an error from the Comedi driver "attach" handler `a2150_attach()` if the probed board index is beyond the end of the array. Signed-off-by: Ian Abbott <abbotti@xxxxxxxxx> --- drivers/staging/comedi/drivers/ni_at_a2150.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/staging/comedi/drivers/ni_at_a2150.c b/drivers/staging/comedi/drivers/ni_at_a2150.c index de67161..32e7bf2 100644 --- a/drivers/staging/comedi/drivers/ni_at_a2150.c +++ b/drivers/staging/comedi/drivers/ni_at_a2150.c @@ -705,7 +705,11 @@ static int a2150_attach(struct comedi_device *dev, struct comedi_devconfig *it) if (ret) return ret; - dev->board_ptr = a2150_boards + a2150_probe(dev); + i = a2150_probe(dev); + if (i >= ARRAY_SIZE(a2150_boards)) + return -ENODEV; + + dev->board_ptr = a2150_boards + i; thisboard = comedi_board(dev); dev->board_name = thisboard->name; -- 2.0.4 _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
