diff options
| author | Len Brown <len.brown@intel.com> | 2008-04-23 00:09:13 -0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-04-23 12:22:13 -0700 |
| commit | 0093cb1199ec551f179562ca9fbd6f64fb750645 (patch) | |
| tree | a17c2166db3d0f78d3ef7400d396476a70c58903 | |
| parent | 94bc891b00e40cbec375feb4568780af183fd7f4 (diff) | |
| download | linux-stable-0093cb1199ec551f179562ca9fbd6f64fb750645.tar.gz linux-stable-0093cb1199ec551f179562ca9fbd6f64fb750645.tar.bz2 linux-stable-0093cb1199ec551f179562ca9fbd6f64fb750645.zip | |
pnpacpi: fix potential corruption on "pnpacpi: exceeded the max number of IRQ resources 2"
PNP_MAX_IRQ is 2
If a device invokes pnpacpi_parse_allocated_irqresource() 0, 1, or 2 times, we are happy.
The 3rd time, we will fail and print "pnpacpi: exceeded the max number of IRQ resources: 2"
The 4th and subsequent calls (if this ever happened) would silently scribble on
irq_resource[2], which doesn't actualy exist.
Found-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | drivers/pnp/pnpacpi/rsparser.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c index 2dcd1960aca8..98cbc9f18eed 100644 --- a/drivers/pnp/pnpacpi/rsparser.c +++ b/drivers/pnp/pnpacpi/rsparser.c @@ -84,10 +84,12 @@ static void pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res, while (!(res->irq_resource[i].flags & IORESOURCE_UNSET) && i < PNP_MAX_IRQ) i++; - if (i >= PNP_MAX_IRQ && !warned) { - printk(KERN_WARNING "pnpacpi: exceeded the max number of IRQ " - "resources: %d \n", PNP_MAX_IRQ); - warned = 1; + if (i >= PNP_MAX_IRQ) { + if (!warned) { + printk(KERN_WARNING "pnpacpi: exceeded the max number" + " of IRQ resources: %d\n", PNP_MAX_IRQ); + warned = 1; + } return; } /* |