pull-request: can 2014-02-12

pull-request: can 2014-02-12

[Marc Kleine-Budde]

Hello David,

this is a pull request with one patch for net/master, for the current release
cycle. Olivier Sobrie noticed and fixed that the kvaser_usb driver doesn't
check the number of channels value from the hardware, which may result in
writing over the bounds of an array in the driver.

regards,
Marc

---

The following changes since commit 738b52bb9845da183b6ff46a8f685b56a63379d1:

  Merge tag 'microblaze-3.14-rc3' of git://git.monstr.eu/linux-2.6-microblaze (2014-02-11 12:24:35 -0800)

are available in the git repository at:


  git://gitorious.org/linux-can/linux-can.git tags/linux-can-fixes-for-3.14-20140212

for you to fetch changes up to 862474f8b46f6c1e600d4934e40ba40646c696ec:

  can: kvaser_usb: check number of channels returned by HW (2014-02-12 10:42:02 +0100)

----------------------------------------------------------------
linux-can-fixes-for-3.14-20140212

----------------------------------------------------------------
Olivier Sobrie (1):
      can: kvaser_usb: check number of channels returned by HW

 drivers/net/can/usb/kvaser_usb.c | 2 ++
 1 file changed, 2 insertions(+)

[PATCH] can: kvaser_usb: check number of channels returned by HW

[Marc Kleine-Budde]

From: Olivier Sobrie <olivier@sobrie.be>

It is needed to check the number of channels returned by the HW because it
cannot be greater than MAX_NET_DEVICES otherwise it will crash.

Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/usb/kvaser_usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 6c859bb..e77d110 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -473,6 +473,8 @@ static int kvaser_usb_get_card_info(struct kvaser_usb *dev)
 		return err;
 
 	dev->nchannels = msg.u.cardinfo.nchannels;
+	if (dev->nchannels > MAX_NET_DEVICES)
+		return -EINVAL;
 
 	return 0;
 }
-- 
1.8.5.3

Re: pull-request: can 2014-02-12

[David Miller]

From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Wed, 12 Feb 2014 11:35:39 +0100

> this is a pull request with one patch for net/master, for the current release
> cycle. Olivier Sobrie noticed and fixed that the kvaser_usb driver doesn't
> check the number of channels value from the hardware, which may result in
> writing over the bounds of an array in the driver.

Pulled, thank you.