Commit 65b40a98 authored by Anton Vasilyev's avatar Anton Vasilyev Committed by Mauro Carvalho Chehab

media: dm1105: Limit number of cards to avoid buffer over read

dm1105_probe() counts number of cards at dm1105_devcount,
but missed bounds check before dereference a card array.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: default avatarAnton Vasilyev <vasilyev@ispras.ru>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
parent 817dc4b5
...@@ -986,6 +986,9 @@ static int dm1105_probe(struct pci_dev *pdev, ...@@ -986,6 +986,9 @@ static int dm1105_probe(struct pci_dev *pdev,
int ret = -ENOMEM; int ret = -ENOMEM;
int i; int i;
if (dm1105_devcount >= ARRAY_SIZE(card))
return -ENODEV;
dev = kzalloc(sizeof(struct dm1105_dev), GFP_KERNEL); dev = kzalloc(sizeof(struct dm1105_dev), GFP_KERNEL);
if (!dev) if (!dev)
return -ENOMEM; return -ENOMEM;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment