tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
isdn/kcapi: fix a small underflow
In get_capi_ctr_by_nr() and get_capi_appl_by_nr() the parameter comes
from skb->data. The current code can underflow to one space before the
start of the array.
The sanity check isn't needed in __get_capi_appl_by_nr() but I changed
it to match the others.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
authored by
Dan Carpenter
and committed by
David S. Miller
25dff94f
057cf65e
+3
-3
+3
-3
drivers/isdn/capi/kcapi.c
+3
-3
drivers/isdn/capi/kcapi.c
···
93
93
94
94
static inline struct capi_ctr *get_capi_ctr_by_nr(u16 contr)
95
95
{
96
-
if (contr - 1 >= CAPI_MAXCONTR)
96
+
if (contr < 1 || contr - 1 >= CAPI_MAXCONTR)
97
97
return NULL;
98
98
99
99
return capi_controller[contr - 1];
···
103
103
{
104
104
lockdep_assert_held(&capi_controller_lock);
105
105
106
-
if (applid - 1 >= CAPI_MAXAPPL)
106
+
if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
107
107
return NULL;
108
108
109
109
return capi_applications[applid - 1];
···
111
111
112
112
static inline struct capi20_appl *get_capi_appl_by_nr(u16 applid)
113
113
{
114
-
if (applid - 1 >= CAPI_MAXAPPL)
114
+
if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
115
115
return NULL;
116
116
117
117
return rcu_dereference(capi_applications[applid - 1]);