Skip to content

Commit

Permalink
parisc: Fix out of array access in match_pci_device()
Browse files Browse the repository at this point in the history
As found by the ubsan checker, the value of the 'index' variable can be
out of range for the bc[] array:

UBSAN: Undefined behaviour in arch/parisc/kernel/drivers.c:655:21
index 6 is out of range for type 'char [6]'
Backtrace:
 [<104fa850>] __ubsan_handle_out_of_bounds+0x68/0x80
 [<1019d83c>] check_parent+0xc0/0x170
 [<1019d91c>] descend_children+0x30/0x6c
 [<1059e164>] device_for_each_child+0x60/0x98
 [<1019cd54>] parse_tree_node+0x40/0x54
 [<1019d86c>] check_parent+0xf0/0x170
 [<1019d91c>] descend_children+0x30/0x6c
 [<1059e164>] device_for_each_child+0x60/0x98
 [<1019d938>] descend_children+0x4c/0x6c
 [<1059e164>] device_for_each_child+0x60/0x98
 [<1019cd54>] parse_tree_node+0x40/0x54
 [<1019cffc>] hwpath_to_device+0xa4/0xc4

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
  • Loading branch information
Helge Deller committed Mar 27, 2018
1 parent a77ab0e commit 615b266
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions arch/parisc/kernel/drivers.c
Original file line number Diff line number Diff line change
Expand Up @@ -651,6 +651,10 @@ static int match_pci_device(struct device *dev, int index,
(modpath->mod == PCI_FUNC(devfn)));
}

/* index might be out of bounds for bc[] */
if (index >= 6)
return 0;

id = PCI_SLOT(pdev->devfn) | (PCI_FUNC(pdev->devfn) << 5);
return (modpath->bc[index] == id);
}
Expand Down

0 comments on commit 615b266

Please sign in to comment.