summaryrefslogtreecommitdiff
path: root/arch
diff options
context:
space:
mode:
authorRobert Reif <reif@earthlink.net>2008-12-26 23:39:11 (GMT)
committerDavid S. Miller <davem@davemloft.net>2008-12-26 23:39:11 (GMT)
commit92d9091f305cc32eb64edc1757d925b93acde6da (patch)
treeeddeec33e27e3eb5d5cf11c0c0e521c0305ea186 /arch
parente6b04fe0bae3c0c9204c8190c8988efa6646ef35 (diff)
downloadlinux-92d9091f305cc32eb64edc1757d925b93acde6da.tar.xz
sparc: fix array overrun check in of_device_64.c
Do the array length check and fixup before copying the array. Signed-off-by: Robert Reif <reif@earthlink.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'arch')
-rw-r--r--arch/sparc/kernel/of_device_64.c18
1 files changed, 9 insertions, 9 deletions
diff --git a/arch/sparc/kernel/of_device_64.c b/arch/sparc/kernel/of_device_64.c
index 0f616ae..46e231f 100644
--- a/arch/sparc/kernel/of_device_64.c
+++ b/arch/sparc/kernel/of_device_64.c
@@ -811,20 +811,20 @@ static struct of_device * __init scan_one_device(struct device_node *dp,
irq = of_get_property(dp, "interrupts", &len);
if (irq) {
- memcpy(op->irqs, irq, len);
op->num_irqs = len / 4;
+
+ /* Prevent overrunning the op->irqs[] array. */
+ if (op->num_irqs > PROMINTR_MAX) {
+ printk(KERN_WARNING "%s: Too many irqs (%d), "
+ "limiting to %d.\n",
+ dp->full_name, op->num_irqs, PROMINTR_MAX);
+ op->num_irqs = PROMINTR_MAX;
+ }
+ memcpy(op->irqs, irq, op->num_irqs * 4);
} else {
op->num_irqs = 0;
}
- /* Prevent overrunning the op->irqs[] array. */
- if (op->num_irqs > PROMINTR_MAX) {
- printk(KERN_WARNING "%s: Too many irqs (%d), "
- "limiting to %d.\n",
- dp->full_name, op->num_irqs, PROMINTR_MAX);
- op->num_irqs = PROMINTR_MAX;
- }
-
build_device_resources(op, parent);
for (i = 0; i < op->num_irqs; i++)
op->irqs[i] = build_one_device_irq(op, parent, op->irqs[i]);