From e988e1f3f975a9d6013c6356c5b9369540c091f9 Mon Sep 17 00:00:00 2001 From: Ian Abbott Date: Mon, 1 Sep 2014 14:13:30 +0100 Subject: [PATCH] staging: comedi: ni_at_a2150: range check board index The "ni_at_a2150" driver determines the board type by calling `a2150_probe()`. This reads a register and converts it to a board index in the range 0 to 3. However, the board table array it indexes into (`a2150_boards[]`) only has 2 entries. Return an error from the Comedi driver "attach" handler `a2150_attach()` if the probed board index is beyond the end of the array. Signed-off-by: Ian Abbott Reviewed-by: H Hartley Sweeten Signed-off-by: Greg Kroah-Hartman --- drivers/staging/comedi/drivers/ni_at_a2150.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/staging/comedi/drivers/ni_at_a2150.c b/drivers/staging/comedi/drivers/ni_at_a2150.c index de67161f6185..32e7bf277781 100644 --- a/drivers/staging/comedi/drivers/ni_at_a2150.c +++ b/drivers/staging/comedi/drivers/ni_at_a2150.c @@ -705,7 +705,11 @@ static int a2150_attach(struct comedi_device *dev, struct comedi_devconfig *it) if (ret) return ret; - dev->board_ptr = a2150_boards + a2150_probe(dev); + i = a2150_probe(dev); + if (i >= ARRAY_SIZE(a2150_boards)) + return -ENODEV; + + dev->board_ptr = a2150_boards + i; thisboard = comedi_board(dev); dev->board_name = thisboard->name; -- 2.34.1