* [patch] isdn/kcapi: fix a small underflow
@ 2013-05-19 18:36 Dan Carpenter
2013-05-20 20:38 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2013-05-19 18:36 UTC (permalink / raw)
To: Karsten Keil; +Cc: netdev, kernel-janitors, David S. Miller
In get_capi_ctr_by_nr() and get_capi_appl_by_nr() the parameter comes
from skb->data. The current code can underflow to one space before the
start of the array.
The sanity check isn't needed in __get_capi_appl_by_nr() but I changed
it to match the others.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index 9b1b274..c123709 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -93,7 +93,7 @@ capi_ctr_put(struct capi_ctr *ctr)
static inline struct capi_ctr *get_capi_ctr_by_nr(u16 contr)
{
- if (contr - 1 >= CAPI_MAXCONTR)
+ if (contr < 1 || contr - 1 >= CAPI_MAXCONTR)
return NULL;
return capi_controller[contr - 1];
@@ -103,7 +103,7 @@ static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid)
{
lockdep_assert_held(&capi_controller_lock);
- if (applid - 1 >= CAPI_MAXAPPL)
+ if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
return NULL;
return capi_applications[applid - 1];
@@ -111,7 +111,7 @@ static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid)
static inline struct capi20_appl *get_capi_appl_by_nr(u16 applid)
{
- if (applid - 1 >= CAPI_MAXAPPL)
+ if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
return NULL;
return rcu_dereference(capi_applications[applid - 1]);
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch] isdn/kcapi: fix a small underflow
2013-05-19 18:36 [patch] isdn/kcapi: fix a small underflow Dan Carpenter
@ 2013-05-20 20:38 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2013-05-20 20:38 UTC (permalink / raw)
To: dan.carpenter; +Cc: isdn, netdev, kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Sun, 19 May 2013 21:36:36 +0300
> In get_capi_ctr_by_nr() and get_capi_appl_by_nr() the parameter comes
> from skb->data. The current code can underflow to one space before the
> start of the array.
>
> The sanity check isn't needed in __get_capi_appl_by_nr() but I changed
> it to match the others.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied, thanks Dan.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-05-20 20:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-05-19 18:36 [patch] isdn/kcapi: fix a small underflow Dan Carpenter
2013-05-20 20:38 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).