summaryrefslogtreecommitdiff
path: root/drivers/char/raw.c
diff options
context:
space:
mode:
authorPaul Bolle <pebolle@tiscali.nl>2014-02-05 02:23:12 +0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-02-07 20:29:46 +0400
commit5bbb2ae3d6f896f8d2082d1eceb6131c2420b7cf (patch)
tree3149c5f0fa942917ed97655062377f9a184881ba /drivers/char/raw.c
parent269f979467cf49f2ea8132316c1f00f8c9678f7c (diff)
downloadlinux-5bbb2ae3d6f896f8d2082d1eceb6131c2420b7cf.tar.xz
raw: test against runtime value of max_raw_minors
bind_get() checks the device number it is called with. It uses MAX_RAW_MINORS for the upper bound. But MAX_RAW_MINORS is set at compile time while the actual number of raw devices can be set at runtime. This means the test can either be too strict or too lenient. And if the test ends up being too lenient bind_get() might try to access memory beyond what was allocated for "raw_devices". So check against the runtime value (max_raw_minors) in this function. Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Acked-by: Jan Kara <jack@suse.cz> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/char/raw.c')
-rw-r--r--drivers/char/raw.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index f3223aac4df1..6e8d65e9b1d3 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -190,7 +190,7 @@ static int bind_get(int number, dev_t *dev)
struct raw_device_data *rawdev;
struct block_device *bdev;
- if (number <= 0 || number >= MAX_RAW_MINORS)
+ if (number <= 0 || number >= max_raw_minors)
return -EINVAL;
rawdev = &raw_devices[number];