From 4712d3796f19b32241b41e538107fb7ae7a3fcff Mon Sep 17 00:00:00 2001 From: Chengguang Xu Date: Fri, 15 Feb 2019 20:27:12 +0800 Subject: chardev: add a check for given minor range register_chrdev_region() carefully checks minor range before calling __register_chrdev_region() but there is another path from alloc_chrdev_region() which does not check the range properly. So add a check for given minor range in __register_chrdev_region(). Signed-off-by: Chengguang Xu Signed-off-by: Greg Kroah-Hartman --- fs/char_dev.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'fs/char_dev.c') diff --git a/fs/char_dev.c b/fs/char_dev.c index 8a63cfa29005..6803e98414f1 100644 --- a/fs/char_dev.c +++ b/fs/char_dev.c @@ -104,6 +104,12 @@ __register_chrdev_region(unsigned int major, unsigned int baseminor, int ret = 0; int i; + if (minorct > MINORMASK + 1 - baseminor) { + pr_err("CHRDEV \"%s\" minor range requested (%u-%u) is out of range of maximum range (%u-%u) for a single major\n", + name, baseminor, baseminor + minorct - 1, 0, MINORMASK); + return ERR_PTR(-EINVAL); + } + cd = kzalloc(sizeof(struct char_device_struct), GFP_KERNEL); if (cd == NULL) return ERR_PTR(-ENOMEM); -- cgit