leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

staging: comedi: verify array index is correct before using it

Browse Source 
This code reads from the array before verifying that "trig" is a valid
index.  If the index is wildly out of bounds then reading from an
invalid address could lead to an Oops.

Fixes: a8c66b684e ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20200709102936.GA20875@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2020-07-09 13:29:36 +03:00 committed by Greg Kroah-Hartman
parent 617894cd84
commit ef75e14a6c
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/staging/comedi/drivers/addi_apci_1500.c
View File

@ -456,9 +456,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
unsigned int lo_mask = data[5] << shift;
unsigned int chan_mask = hi_mask | lo_mask;
unsigned int old_mask = (1 << shift) - 1;
unsigned int pm = devpriv->pm[trig] & old_mask;
unsigned int pt = devpriv->pt[trig] & old_mask;
unsigned int pp = devpriv->pp[trig] & old_mask;
unsigned int pm;
unsigned int pt;
unsigned int pp;
if (trig > 1) {
dev_dbg(dev->class_dev,
@ -471,6 +471,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
return -EINVAL;
}
pm = devpriv->pm[trig] & old_mask;
pt = devpriv->pt[trig] & old_mask;
pp = devpriv->pp[trig] & old_mask;
switch (data[2]) {
case COMEDI_DIGITAL_TRIG_DISABLE:
/* clear trigger configuration */