android_kernel_google_msm/drivers/char
Paul Bolle e24cfb1b4f raw: test against runtime value of max_raw_minors
commit 5bbb2ae3d6 upstream.

bind_get() checks the device number it is called with. It uses
MAX_RAW_MINORS for the upper bound. But MAX_RAW_MINORS is set at compile
time while the actual number of raw devices can be set at runtime. This
means the test can either be too strict or too lenient. And if the test
ends up being too lenient bind_get() might try to access memory beyond
what was allocated for "raw_devices".

So check against the runtime value (max_raw_minors) in this function.

Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-22 10:32:45 -08:00
..
agp char/agp: add another Ironlake host bridge 2012-06-17 11:21:22 -07:00
hw_random virtio: rng: disallow multiple device registrations, fixes crashes 2013-03-20 13:04:57 -07:00
ipmi ipmi: ipmi_devintf: compat_ioctl method fails to take ipmi_mutex 2013-05-19 10:54:49 -07:00
mwave Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
pcmcia Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
tpm tpm: Propagate error from tpm_transmit to fix a timeout hang 2012-10-21 09:28:01 -07:00
xilinx_hwicap Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
apm-emulation.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/apm 2012-04-05 17:34:30 -07:00
applicom.c
applicom.h
bfin-otp.c
bsr.c
ds1302.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
ds1620.c
dsp56k.c
dtlk.c
efirtc.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
generic_nvram.c
genrtc.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
hangcheck-timer.c
hpet.c vm: convert HPET mmap to vm_iomap_memory() helper 2013-04-25 21:19:56 -07:00
i8k.c drivers/char/i8k.c: add Dell XPLS L421X 2013-12-11 22:34:12 -08:00
Kconfig tty: delete briq_panel.c driver 2012-03-08 10:45:55 -08:00
lp.c Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2012-03-29 18:12:23 -07:00
Makefile tty: delete briq_panel.c driver 2012-03-08 10:45:55 -08:00
mbcs.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
mbcs.h
mem.c
misc.c
mmtimer.c
msm_smd_pkt.c
mspec.c Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts 2012-08-15 08:10:04 -07:00
nsc_gpio.c
nvram.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
nwbutton.c
nwbutton.h
nwflash.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
pc8736x_gpio.c
ppdev.c
ps3flash.c
ramoops.c char/ramoops: included linux/err.h twice 2012-02-24 14:16:43 -08:00
random.c random: run random_int_secret_init() run after all late_initcalls 2013-10-22 09:02:25 +01:00
raw.c raw: test against runtime value of max_raw_minors 2014-02-22 10:32:45 -08:00
rtc.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
scx200_gpio.c
snsc.c
snsc.h
snsc_event.c
sonypi.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
tb0219.c
tile-srom.c tile-srom.c driver: minor code cleanup 2012-04-02 12:14:10 -04:00
tlclk.c
toshiba.c
ttyprintk.c TTY: ttyprintk, don't touch behind tty->write_buf 2012-10-07 08:32:24 -07:00
uv_mmtimer.c
virtio_console.c virtio: console: return -ENODEV on all read operations after unplug 2013-08-14 22:57:07 -07:00