| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 21 Oct 2013 22:05:37 +0300 From: Tomas Winkler <tomas.winkler@...el.com> To: gregkh@...uxfoundation.org Cc: arnd@...db.de, linux-kernel@...r.kernel.org, Tomas Winkler <tomas.winkler@...el.com> Subject: [char-misc-next 2/8] mei: hbm: validate client index is not exceeding allocated array size Signed-off-by: Tomas Winkler <tomas.winkler@...el.com> --- drivers/misc/mei/hbm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c index 9b3a0fb..0f5e8ca 100644 --- a/drivers/misc/mei/hbm.c +++ b/drivers/misc/mei/hbm.c @@ -228,8 +228,6 @@ static int mei_hbm_prop_req(struct mei_device *dev) unsigned long client_num; - client_num = dev->me_client_presentation_num; - next_client_index = find_next_bit(dev->me_clients_map, MEI_CLIENTS_MAX, dev->me_client_index); @@ -241,6 +239,10 @@ static int mei_hbm_prop_req(struct mei_device *dev) return 0; } + client_num = dev->me_client_presentation_num; + if (WARN_ON(dev->me_clients_num <= client_num)) + return -EIO; + dev->me_clients[client_num].client_id = next_client_index; dev->me_clients[client_num].mei_flow_ctrl_creds = 0; -- 1.8.3.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists