On Tue, Aug 03, 2010 at 02:38:19AM +0200, Christoph Fritz wrote:
> Hi,
>
> buffer overflow in next-tree's commit
> 6f0f38c45a8f2f511c25893e33011ff32fc811db:
> size of array pcmcia_used_irq[] can be less than 32
>
> in drivers/pcmcia/pcmcia_resource.c
> +static int pcmcia_setup_isa_irq(struct pcmcia_device *p_dev, int type)
> +{
> [..]
> + for (try = 0; try < 64; try++) {
> + irq = try % 32;
> [..]
> +
> + /* avoid an IRQ which is already used by another PCMCIA
> card */
> + if ((try < 32) && pcmcia_used_irq[irq])
> + continue;
>
> drivers/pcmcia/pcmcia_resource.c
> static u8 pcmcia_used_irq[NR_IRQS];
>
> arch/x86/include/asm/irq_vectors.h
> #define NR_IRQS_LEGACY 16
> [..]
> #else /* !CONFIG_X86_IO_APIC: */
> # define NR_IRQS NR_IRQS_LEGACY
> #endif
>
> ---
> non-tested fix:
What about this?
[PATCH] pcmcia: avoid buffer overflow in pcmcia_setup_isa_irq
NR_IRQS may be as low as 16, causing a (harmless?) buffer overflow in
pcmcia_setup_isa_irq():
static u8 pcmcia_used_irq[NR_IRQS];
...
if ((try < 32) && pcmcia_used_irq[irq])
continue;
This is read-only, so if this address would be non-zero, it would just
mean we would not attempt an IRQ >= NR_IRQS -- which would fail anyway!
And as request_irq() fails for an irq >= NR_IRQS, the setting code path:
pcmcia_used_irq[irq]++;
is never reached as well.
Reported-by: Christoph Fritz <chf.fr...@googlemail.com>
CC: sta...@kernel.org
Signed-off-by: Dominik Brodowski <li...@dominikbrodowski.net>
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index d48437f..54aa1c2 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -677,7 +677,7 @@ EXPORT_SYMBOL(__pcmcia_request_exclusive_irq);
#ifdef CONFIG_PCMCIA_PROBE
/* mask of IRQs already reserved by other cards, we should avoid using them */
-static u8 pcmcia_used_irq[NR_IRQS];
+static u8 pcmcia_used_irq[32];
static irqreturn_t test_action(int cpl, void *dev_id)
{
@@ -700,6 +700,9 @@ static int pcmcia_setup_isa_irq(struct pcmcia_device
*p_dev, int type)
for (try = 0; try < 64; try++) {
irq = try % 32;
+ if (irq > NR_IRQS)
+ continue;
+
/* marked as available by driver, not blocked by userspace? */
if (!((mask >> irq) & 1))
continue;
_______________________________________________
Linux PCMCIA reimplementation list
http://lists.infradead.org/mailman/listinfo/linux-pcmcia
