Commit a3edd4dd authored May 21, 2021 by Yu Kuai Committed by Greg Kroah-Hartman Jul 20, 2021

char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol()



[ Upstream commit 37188559c610f1b7eec83c8e448936c361c578de ]

Theoretically, it will cause index out of bounds error if
'num_bytes_read' is greater than 4. As we expect it(and was tested)
never to be greater than 4, error out if it happens.

Fixes: c1986ee9 ("[PATCH] New Omnikey Cardman 4000 driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20210521120617.138396-1-yukuai3@huawei.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 77e90674

drivers/char/pcmcia/cm4000_cs.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -544,6 +544,10 @@ static int set_protocol(struct cm4000_dev dev, struct ptsreq ptsreq)
		io_read_num_rec_bytes(iobase, &num_bytes_read);
		if (num_bytes_read >= 4) {
		DEBUGP(2, dev, "NumRecBytes = %i\n", num_bytes_read);
		if (num_bytes_read > 4) {
		rc = -EIO;
		goto exit_setprotocol;
		}
		break;
		}
		mdelay(10);