commit 28e84ab3abafb0f9c9573993626abe6ca3fa8eb1
author Robert T. Johnson <rtjohnso@eecs.berkeley.edu> Mon Jun 16 17:20:52 2008 -0700
committer David S. Miller <davem@davemloft.net> Mon Jun 16 17:20:52 2008 -0700
tree 13d7c12e8041d9e0f64c37d6764c492857ab230b
parent 7e903c2ae36efb526eacab3b25d00e90424bd8a8

atm: [he] limit queries to the device's register space

From: "Robert T. Johnson" <rtjohnso@eecs.berkeley.edu>
Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>

drivers/atm/he.c

diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 320320e..fc636a3 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -2845,10 +2845,15 @@
 			if (copy_from_user(&reg, arg,
 					   sizeof(struct he_ioctl_reg)))
 				return -EFAULT;
-			
+
 			spin_lock_irqsave(&he_dev->global_lock, flags);
 			switch (reg.type) {
 				case HE_REGTYPE_PCI:
+					if (reg.addr < 0 || reg.addr >= HE_REGMAP_SIZE) {
+						err = -EINVAL;
+						break;
+					}
+
 					reg.val = he_readl(he_dev, reg.addr);
 					break;
 				case HE_REGTYPE_RCM: