diff mbox

[6/8] slram: fix read buffer overflow

Message ID 200908062305.n76N5aeS004967@imap1.linux-foundation.org
State New, archived
Headers show

Commit Message

Andrew Morton Aug. 6, 2009, 11:05 p.m. UTC 
From: Roel Kluin <roel.kluin@gmail.com>

map[count] is checked before count < SLRAM_MAX_DEVICES_PARAMS

declared on drivers/mtd/devices/slram.c:66:

static char *map[SLRAM_MAX_DEVICES_PARAMS];

[akpm@linux-foundation.org: cleanups]
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 drivers/mtd/devices/slram.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

Comments

Josh Boyer Aug. 7, 2009, 2:58 a.m. UTC | #1 
On Thu, Aug 06, 2009 at 04:05:36PM -0700, akpm@linux-foundation.org wrote:
>From: Roel Kluin <roel.kluin@gmail.com>
>
>map[count] is checked before count < SLRAM_MAX_DEVICES_PARAMS
>
>declared on drivers/mtd/devices/slram.c:66:

Didn't we obsolete this driver with phram?  I don't mean to derail the patch,
but I'm wondering why slram still exists at all.

josh
Artem Bityutskiy Aug. 10, 2009, 7:04 a.m. UTC | #2 
On 08/07/2009 05:58 AM, Josh Boyer wrote:
> On Thu, Aug 06, 2009 at 04:05:36PM -0700, akpm@linux-foundation.org wrote:
>> From: Roel Kluin<roel.kluin@gmail.com>
>>
>> map[count] is checked before count<  SLRAM_MAX_DEVICES_PARAMS
>>
>> declared on drivers/mtd/devices/slram.c:66:
>
> Didn't we obsolete this driver with phram?  I don't mean to derail the patch,
> but I'm wondering why slram still exists at all.

Feel free to send a patch. Meanwhile, I've put this fix to my l2-mtd-2.6.git.
diff mbox

Patch

diff -puN drivers/mtd/devices/slram.c~slram-read-buffer-overflow drivers/mtd/devices/slram.c
--- a/drivers/mtd/devices/slram.c~slram-read-buffer-overflow
+++ a/drivers/mtd/devices/slram.c
@@ -341,9 +341,8 @@  static int __init init_slram(void)
 #else
 	int count;
 
-	for (count = 0; (map[count]) && (count < SLRAM_MAX_DEVICES_PARAMS);
-			count++) {
-	}
+	for (count = 0; count < SLRAM_MAX_DEVICES_PARAMS && map[count]; count++)
+		;
 
 	if ((count % 3 != 0) || (count == 0)) {
 		E("slram: not enough parameters.\n");