On Wed, Aug 12, 2015 at 07:50:25PM +0800, Kang Yin Su wrote: > On 12 August 2015 at 17:46, Alexander Shiyan <shc_work@xxxxxxx> wrote: > >> Среда, 12 августа 2015, 15:36 +08:00 от cantona <cantona@xxxxxxxxxxx>: > >> > >> > >> added Alexander Shiyan < shc_work@xxxxxxx >. > >> > >> On 12 August 2015 at 15:22, Su Kang Yin < cantona@xxxxxxxxxxx > wrote: > >> >Max310x driver supports up to 4 UART devices but array size of > >> >"struct max310x_one" is set to 1. That leads to out of bounds > >> >access on UART port registration. > >> > > >> >This patch fixed it by increase the array size to 4 which is > >> >maximum supported UART. > >> > > >> >Signed-off-by: Su Kang Yin < cantona@xxxxxxxxxxx > > >> >--- > > ... > > > > This seems incorrect. The number of ports is allocated dynamically by: > > ... > > /* Alloc port structure */ > > s = devm_kzalloc(dev, sizeof(*s) + sizeof(struct max310x_one) * devtype->nr, GFP_KERNEL); > > ... > > > > Thanks. > > > > --- > > > > > Oh, my bad. But it looks confusing. So we must ensure "struct > max310x_one p[0]" must the last element of "struct max310x_port". Yes, that is a very common pattern we use in the kernel. -- To unsubscribe from this list: send the line "unsubscribe linux-serial" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
