ibmtr: possible Read buffer overflow?

Prevent read outside array bounds.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by roel kluin and committed by David S. Miller 18eb0893 b0c110ca

+9 -2
+9 -2
drivers/net/tokenring/ibmtr.c
··· 1143 } else { 1144 char **prphase = printphase; 1145 char **prerror = printerror; 1146 DPRINTK("TR Adapter misc open failure, error code = "); 1147 - printk("0x%x, Phase: %s, Error: %s\n", 1148 - err, prphase[err/16 -1], prerror[err%16 -1]); 1149 printk(" retrying after %ds delay...\n", 1150 TR_RETRY_INTERVAL/HZ); 1151 }
··· 1143 } else { 1144 char **prphase = printphase; 1145 char **prerror = printerror; 1146 + int pnr = err / 16 - 1; 1147 + int enr = err % 16 - 1; 1148 DPRINTK("TR Adapter misc open failure, error code = "); 1149 + if (pnr < 0 || pnr >= ARRAY_SIZE(printphase) || 1150 + enr < 0 || 1151 + enr >= ARRAY_SIZE(printerror)) 1152 + printk("0x%x, invalid Phase/Error.", err); 1153 + else 1154 + printk("0x%x, Phase: %s, Error: %s\n", err, 1155 + prphase[pnr], prerror[enr]); 1156 printk(" retrying after %ds delay...\n", 1157 TR_RETRY_INTERVAL/HZ); 1158 }