diff options
| author | David S. Miller <davem@davemloft.net> | 2014-02-13 18:17:03 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-02-13 18:17:03 -0500 |
| commit | b12a0c311d175257292e4e4fcded93856b9c8bf5 (patch) | |
| tree | 414f03ca1df497662f3bfd600b811662aaa6fdf1 | |
| parent | 91ff37ff0b898e1ac8a1557b968a4918250f22ae (diff) | |
| parent | 862474f8b46f6c1e600d4934e40ba40646c696ec (diff) | |
| download | linux-b12a0c311d175257292e4e4fcded93856b9c8bf5.tar.bz2 | |
Merge tag 'linux-can-fixes-for-3.14-20140212' of git://gitorious.org/linux-can/linux-can
linux-can-fixes-for-3.14-20140212
Marc Kleine-Budde says:
====================
this is a pull request with one patch for net/master, for the current release
cycle. Olivier Sobrie noticed and fixed that the kvaser_usb driver doesn't
check the number of channels value from the hardware, which may result in
writing over the bounds of an array in the driver.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/can/usb/kvaser_usb.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c index 6c859bba8b65..e77d11049747 100644 --- a/drivers/net/can/usb/kvaser_usb.c +++ b/drivers/net/can/usb/kvaser_usb.c @@ -473,6 +473,8 @@ static int kvaser_usb_get_card_info(struct kvaser_usb *dev) return err; dev->nchannels = msg.u.cardinfo.nchannels; + if (dev->nchannels > MAX_NET_DEVICES) + return -EINVAL; return 0; } |