raw: test against runtime value of max_raw_minors
authorPaul Bolle <pebolle@tiscali.nl>
Tue, 4 Feb 2014 22:23:12 +0000 (23:23 +0100)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 1 Apr 2014 23:58:49 +0000 (00:58 +0100)
commitf934bf515d57d597ea1b6b001e80dcda8d369cf7
treed26437419970d252188422e11c2f2e604643f919
parente17acbd7b5831a07b7582a1cb1cddb38ea12b2f3
raw: test against runtime value of max_raw_minors

commit 5bbb2ae3d6f896f8d2082d1eceb6131c2420b7cf upstream.

bind_get() checks the device number it is called with. It uses
MAX_RAW_MINORS for the upper bound. But MAX_RAW_MINORS is set at compile
time while the actual number of raw devices can be set at runtime. This
means the test can either be too strict or too lenient. And if the test
ends up being too lenient bind_get() might try to access memory beyond
what was allocated for "raw_devices".

So check against the runtime value (max_raw_minors) in this function.

Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/char/raw.c