diff options
| author | Ian Abbott <abbotti@mev.co.uk> | 2014-09-01 13:13:30 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-09-08 20:44:22 (GMT) |
| commit | e988e1f3f975a9d6013c6356c5b9369540c091f9 (patch) | |
| tree | be56538190e99343917a55656deac5e6c27620f7 | |
| parent | 395262a9e69042b82293f8b6bcd7a48b2fd215de (diff) | |
| download | linux-e988e1f3f975a9d6013c6356c5b9369540c091f9.tar.xz | |
staging: comedi: ni_at_a2150: range check board index
The "ni_at_a2150" driver determines the board type by calling
`a2150_probe()`. This reads a register and converts it to a board index
in the range 0 to 3. However, the board table array it indexes into
(`a2150_boards[]`) only has 2 entries. Return an error from the
Comedi driver "attach" handler `a2150_attach()` if the probed board
index is beyond the end of the array.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/comedi/drivers/ni_at_a2150.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/staging/comedi/drivers/ni_at_a2150.c b/drivers/staging/comedi/drivers/ni_at_a2150.c index de67161..32e7bf2 100644 --- a/drivers/staging/comedi/drivers/ni_at_a2150.c +++ b/drivers/staging/comedi/drivers/ni_at_a2150.c @@ -705,7 +705,11 @@ static int a2150_attach(struct comedi_device *dev, struct comedi_devconfig *it) if (ret) return ret; - dev->board_ptr = a2150_boards + a2150_probe(dev); + i = a2150_probe(dev); + if (i >= ARRAY_SIZE(a2150_boards)) + return -ENODEV; + + dev->board_ptr = a2150_boards + i; thisboard = comedi_board(dev); dev->board_name = thisboard->name; |