• Jiri Slaby's avatar
    tty: rocket, avoid OOB access · 7127d243
    Jiri Slaby authored
    init_r_port can access pc104 array out of bounds. pc104 is a 2D array
    defined to have 4 members. Each member has 8 submembers.
    * we can have more than 4 (PCI) boards, i.e. [board] can be OOB
    * line is not modulo-ed by anything, so the first line on the second
      board can be 4, on the 3rd 12 or alike (depending on previously
      registered boards). It's zero only on the first line of the first
      board. So even [line] can be OOB, quite soon (with the 2nd registered
      board already).
    
    This code is broken for ages, so just avoid the OOB accesses and don't
    try to fix it as we would need to find out the correct line number. Use
    the default: RS232, if we are out.
    
    Generally, if anyone needs to set the interface types, a module parameter
    is past the last thing that should be used for this purpose. The
    parameters' description says it's for ISA cards anyway.
    Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
    Cc: stable <stable@vger.kernel.org>
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Link: https://lore.kernel.org/r/20200417105959.15201-2-jslaby@suse.czSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    7127d243
rocket.c 92.2 KB