From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
	by smtp.lore.kernel.org (Postfix) with ESMTP id D07AFC43334
	for <linux-kernel@archiver.kernel.org>; Fri, 10 Jun 2022 13:28:30 +0000 (UTC)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1348715AbiFJN2Q (ORCPT
        <rfc822;linux-kernel@archiver.kernel.org>);
        Fri, 10 Jun 2022 09:28:16 -0400
Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51586 "EHLO
        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1345932AbiFJN2K (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 10 Jun 2022 09:28:10 -0400
Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1])
        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 13CC7210F93
        for <linux-kernel@vger.kernel.org>; Fri, 10 Jun 2022 06:28:08 -0700 (PDT)
Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140])
        (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
        (No client certificate requested)
        by dfw.source.kernel.org (Postfix) with ESMTPS id A3C986196E
        for <linux-kernel@vger.kernel.org>; Fri, 10 Jun 2022 13:28:07 +0000 (UTC)
Received: by smtp.kernel.org (Postfix) with ESMTPSA id AC1DBC34114;
        Fri, 10 Jun 2022 13:28:06 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
        s=korg; t=1654867687;
        bh=/huRNf7iDo2vUg30P8tgoQxcn23LPNAS9S4NZiDWXuA=;
        h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
        b=Eo8JHQWyICc9bS0qS1ou80vn5R8Ma3EroCcKaiYsM59mbv9hKiLjuTU8TTmKpqgnX
         HCoywIXquyQ3g1fn8jwg861uqutf3Eu0dmJvrS+gKDiUUEqjlW8BLpuO+w/8FYyLWf
         XPhC8Df4fGvWk5ngkc/MqAUmfUNaZJiwUt5NrEXM=
Date:   Fri, 10 Jun 2022 15:28:04 +0200
From:   Greg KH <gregkh@linuxfoundation.org>
To:     Shreenidhi Shedi <yesshedi@gmail.com>
Cc:     arnd@arndb.de, linux-kernel@vger.kernel.org,
        Shreenidhi Shedi <sshedi@vmware.com>
Subject: Re: [PATCH 1/2] char: lp: ensure that index has not exceeded LP_NO
Message-ID: <YqNG5H+JbNJMeOWq@kroah.com>
References: <20220603130040.601673-1-sshedi@vmware.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220603130040.601673-1-sshedi@vmware.com>
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Jun 03, 2022 at 06:30:39PM +0530, Shreenidhi Shedi wrote:
> From: Shreenidhi Shedi <sshedi@vmware.com>
> 
> After finishing the loop, index value can be equal to LP_NO and lp_table
> array is of size LP_NO, so this can end up in accessing an out of bound
> address in lp_register function.
> 
> Signed-off-by: Shreenidhi Shedi <sshedi@vmware.com>
> ---
>  drivers/char/lp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/char/lp.c b/drivers/char/lp.c
> index 0e22e3b0a..d474d02b6 100644
> --- a/drivers/char/lp.c
> +++ b/drivers/char/lp.c
> @@ -972,7 +972,7 @@ static void lp_attach(struct parport *port)
>  			if (port_num[i] == -1)
>  				break;
> 
> -		if (!lp_register(i, port))
> +		if (i < LP_NO && !lp_register(i, port))
>  			lp_count++;

How can this ever be needed?  Look at the check further up for the check
of lp_count which prevents this from every going too large.

So how can an address be accessed out of bound here?

thanks,

greg k-h