diff options
| author | Robert T. Johnson <rtjohnso@eecs.berkeley.edu> | 2008-06-16 17:20:52 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-06-16 17:20:52 -0700 |
| commit | 28e84ab3abafb0f9c9573993626abe6ca3fa8eb1 (patch) | |
| tree | 13d7c12e8041d9e0f64c37d6764c492857ab230b /drivers | |
| parent | 7e903c2ae36efb526eacab3b25d00e90424bd8a8 (diff) | |
| download | linux-28e84ab3abafb0f9c9573993626abe6ca3fa8eb1.tar.bz2 | |
atm: [he] limit queries to the device's register space
From: "Robert T. Johnson" <rtjohnso@eecs.berkeley.edu>
Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/atm/he.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/atm/he.c b/drivers/atm/he.c index 320320e3dfb3..fc636a3429cf 100644 --- a/drivers/atm/he.c +++ b/drivers/atm/he.c @@ -2845,10 +2845,15 @@ he_ioctl(struct atm_dev *atm_dev, unsigned int cmd, void __user *arg) if (copy_from_user(®, arg, sizeof(struct he_ioctl_reg))) return -EFAULT; - + spin_lock_irqsave(&he_dev->global_lock, flags); switch (reg.type) { case HE_REGTYPE_PCI: + if (reg.addr < 0 || reg.addr >= HE_REGMAP_SIZE) { + err = -EINVAL; + break; + } + reg.val = he_readl(he_dev, reg.addr); break; case HE_REGTYPE_RCM: |