Commit 92d9091f authored by Robert Reif's avatar Robert Reif Committed by David S. Miller

sparc: fix array overrun check in of_device_64.c

Do the array length check and fixup before copying the array.
Signed-off-by: default avatarRobert Reif <reif@earthlink.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e6b04fe0
......@@ -811,11 +811,7 @@ static struct of_device * __init scan_one_device(struct device_node *dp,
irq = of_get_property(dp, "interrupts", &len);
if (irq) {
memcpy(op->irqs, irq, len);
op->num_irqs = len / 4;
} else {
op->num_irqs = 0;
}
/* Prevent overrunning the op->irqs[] array. */
if (op->num_irqs > PROMINTR_MAX) {
......@@ -824,6 +820,10 @@ static struct of_device * __init scan_one_device(struct device_node *dp,
dp->full_name, op->num_irqs, PROMINTR_MAX);
op->num_irqs = PROMINTR_MAX;
}
memcpy(op->irqs, irq, op->num_irqs * 4);
} else {
op->num_irqs = 0;
}
build_device_resources(op, parent);
for (i = 0; i < op->num_irqs; i++)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment