Re: [PATCH v2] serial: max310x: Fix out of bounds access

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



> Среда, 12 августа 2015, 15:36 +08:00 от cantona <cantona@xxxxxxxxxxx>:
> 
> 
> added Alexander Shiyan < shc_work@xxxxxxx >.
> 
> On 12 August 2015 at 15:22, Su Kang Yin  < cantona@xxxxxxxxxxx > wrote:
> >Max310x driver supports up to 4 UART devices but array size of
> >"struct max310x_one" is set to 1. That leads to out of bounds
> >access on UART port registration.
> >
> >This patch fixed it by increase the array size to 4 which is
> >maximum supported UART.
> >
> >Signed-off-by: Su Kang Yin < cantona@xxxxxxxxxxx >
> >---
...

This seems incorrect. The number of ports is allocated dynamically by:
...
/* Alloc port structure */
s = devm_kzalloc(dev, sizeof(*s) + sizeof(struct max310x_one) * devtype->nr, GFP_KERNEL);
...

Thanks.

---

��.n��������+%������w��{.n�����{��ǫ����{ay�ʇڙ���f���h������_�(�階�ݢj"��������G����?���&��




[Index of Archives]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Linux PPP]     [Linux FS]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Linmodem]     [Device Mapper]     [Linux Kernel for ARM]

  Powered by Linux