From: Ian Abbott Date: Mon, 1 Sep 2014 13:13:30 +0000 (+0100) Subject: staging: comedi: ni_at_a2150: range check board index X-Git-Tag: v3.18-rc1~130^2~760 X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=e988e1f3f975a9d6013c6356c5b9369540c091f9;p=karo-tx-linux.git staging: comedi: ni_at_a2150: range check board index The "ni_at_a2150" driver determines the board type by calling `a2150_probe()`. This reads a register and converts it to a board index in the range 0 to 3. However, the board table array it indexes into (`a2150_boards[]`) only has 2 entries. Return an error from the Comedi driver "attach" handler `a2150_attach()` if the probed board index is beyond the end of the array. Signed-off-by: Ian Abbott Reviewed-by: H Hartley Sweeten Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/comedi/drivers/ni_at_a2150.c b/drivers/staging/comedi/drivers/ni_at_a2150.c index de67161f6185..32e7bf277781 100644 --- a/drivers/staging/comedi/drivers/ni_at_a2150.c +++ b/drivers/staging/comedi/drivers/ni_at_a2150.c @@ -705,7 +705,11 @@ static int a2150_attach(struct comedi_device *dev, struct comedi_devconfig *it) if (ret) return ret; - dev->board_ptr = a2150_boards + a2150_probe(dev); + i = a2150_probe(dev); + if (i >= ARRAY_SIZE(a2150_boards)) + return -ENODEV; + + dev->board_ptr = a2150_boards + i; thisboard = comedi_board(dev); dev->board_name = thisboard->name;