On Feb 04 Tejun Heo wrote: > fw_device_init() didn't check whether the allocated minor number isn't > too large. Fail if it goes overflows MINORBITS. > > Signed-off-by: Tejun Heo <[email protected]> > Suggested-by: Stefan Richter <[email protected]> > Cc: [email protected] > --- > drivers/firewire/core-device.c | 4 ++++ > 1 file changed, 4 insertions(+) > > --- a/drivers/firewire/core-device.c > +++ b/drivers/firewire/core-device.c > @@ -1020,6 +1020,10 @@ static void fw_device_init(struct work_s > ret = idr_pre_get(&fw_device_idr, GFP_KERNEL) ? > idr_get_new(&fw_device_idr, device, &minor) : > -ENOMEM; > + if (minor >= 1 << MINORBITS) { > + idr_remove(&fw_device_idr, minor); > + minor = -ENOSPC; > + } > up_write(&fw_device_rwsem); > > if (ret < 0)
Thanks; routing together with the other idr patches through mm Acked-by: Stefan Richter <[email protected]> Not totally sure whether to bother -stable with this, as this condition is rather difficult to provoke. But since the fix is small and "obvious", why not. -- Stefan Richter -=====-===-= --=- --=-- http://arcgraph.de/sr/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
