All of lore.kernel.org
 help / color / mirror / Atom feed
From: Andy Lutomirski <luto@kernel.org>
To: "Pali Rohár" <pali.rohar@gmail.com>,
	platform-driver-x86@vger.kernel.org,
	"Jean Delvare" <jdelvare@suse.de>
Cc: linux-kernel@vger.kernel.org, Andy Lutomirski <luto@kernel.org>
Subject: [PATCH v2 2/3] dell-wmi: Fix hotkey table size check
Date: Mon, 18 Jan 2016 12:59:39 -0800	[thread overview]
Message-ID: <0282cf1f0c15ae9006b119dd92bfb4bad2e924a7.1453150613.git.luto@kernel.org> (raw)
In-Reply-To: <cover.1453150613.git.luto@kernel.org>
In-Reply-To: <cover.1453150613.git.luto@kernel.org>

The minimum size of the table is 4, not 6.  Replace the hard-coded
number with a sizeof expression.  While we're at it, repace the
hard-coded 4 below as well.

Reported-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---
 drivers/platform/x86/dell-wmi.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 5c0d037fcd40..48838942d593 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -111,7 +111,6 @@ struct dell_bios_keymap_entry {
 struct dell_bios_hotkey_table {
 	struct dmi_header header;
 	struct dell_bios_keymap_entry keymap[];
-
 };
 
 struct dell_dmi_results {
@@ -329,12 +328,14 @@ static void __init handle_dmi_entry(const struct dmi_header *dm,
 	if (results->err || results->keymap)
 		return;		/* We already found the hotkey table. */
 
-	if (dm->type != 0xb2 || dm->length <= 6)
+	if (dm->type != 0xb2 ||
+	    dm->length <= sizeof(struct dell_bios_hotkey_table))
 		return;
 
 	table = container_of(dm, struct dell_bios_hotkey_table, header);
 
-	hotkey_num = (table->header.length - 4) /
+	hotkey_num = (table->header.length -
+		      sizeof(struct dell_bios_hotkey_table)) /
 				sizeof(struct dell_bios_keymap_entry);
 
 	keymap = kcalloc(hotkey_num + 1, sizeof(struct key_entry), GFP_KERNEL);
-- 
2.5.0

  parent reply	other threads:[~2016-01-18 20:59 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-18 20:59 [PATCH v2 0/3] dell-wmi: DMI misuse fixes Andy Lutomirski
2016-01-18 20:59 ` [PATCH v2 1/3] dell-wmi: Stop storing pointers to DMI tables Andy Lutomirski
2016-01-19  8:41   ` Jean Delvare
2016-01-19 11:04   ` Jean Delvare
2016-01-19 18:28     ` Andy Lutomirski
2016-01-18 20:59 ` Andy Lutomirski [this message]
2016-01-19  8:31   ` [PATCH v2 2/3] dell-wmi: Fix hotkey table size check Jean Delvare
2016-01-19 18:42     ` Andy Lutomirski
2016-01-18 20:59 ` [PATCH v2 3/3] dmi: Make dmi_walk and dmi_walk_early return real error codes Andy Lutomirski
2016-01-19  7:54   ` Jean Delvare
2016-01-19  8:36     ` Pali Rohár
2016-01-19  9:03       ` Jean Delvare
2016-01-19  9:07         ` Pali Rohár
2016-01-19  9:40           ` Jean Delvare
2016-01-19 23:51             ` Andy Lutomirski

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0282cf1f0c15ae9006b119dd92bfb4bad2e924a7.1453150613.git.luto@kernel.org \
    --to=luto@kernel.org \
    --cc=jdelvare@suse.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pali.rohar@gmail.com \
    --cc=platform-driver-x86@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.