From patchwork Mon Jan 18 20:59:39 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Lutomirski X-Patchwork-Id: 8057261 Return-Path: X-Original-To: patchwork-platform-driver-x86@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id BC6B8BEEE5 for ; Mon, 18 Jan 2016 20:59:56 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 03A6320439 for ; Mon, 18 Jan 2016 20:59:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1AE2F20120 for ; Mon, 18 Jan 2016 20:59:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932423AbcARU7u (ORCPT ); Mon, 18 Jan 2016 15:59:50 -0500 Received: from mail.kernel.org ([198.145.29.136]:47192 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932164AbcARU7s (ORCPT ); Mon, 18 Jan 2016 15:59:48 -0500 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 73B8920430; Mon, 18 Jan 2016 20:59:46 +0000 (UTC) Received: from localhost (c-71-202-137-17.hsd1.ca.comcast.net [71.202.137.17]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B375120414; Mon, 18 Jan 2016 20:59:45 +0000 (UTC) From: Andy Lutomirski To: =?UTF-8?q?Pali=20Roh=C3=A1r?= , platform-driver-x86@vger.kernel.org, Jean Delvare Cc: linux-kernel@vger.kernel.org, Andy Lutomirski Subject: [PATCH v2 2/3] dell-wmi: Fix hotkey table size check Date: Mon, 18 Jan 2016 12:59:39 -0800 Message-Id: <0282cf1f0c15ae9006b119dd92bfb4bad2e924a7.1453150613.git.luto@kernel.org> X-Mailer: git-send-email 2.5.0 In-Reply-To: References: In-Reply-To: References: X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Sender: platform-driver-x86-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: platform-driver-x86@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The minimum size of the table is 4, not 6. Replace the hard-coded number with a sizeof expression. While we're at it, repace the hard-coded 4 below as well. Reported-by: Jean Delvare Signed-off-by: Andy Lutomirski --- drivers/platform/x86/dell-wmi.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c index 5c0d037fcd40..48838942d593 100644 --- a/drivers/platform/x86/dell-wmi.c +++ b/drivers/platform/x86/dell-wmi.c @@ -111,7 +111,6 @@ struct dell_bios_keymap_entry { struct dell_bios_hotkey_table { struct dmi_header header; struct dell_bios_keymap_entry keymap[]; - }; struct dell_dmi_results { @@ -329,12 +328,14 @@ static void __init handle_dmi_entry(const struct dmi_header *dm, if (results->err || results->keymap) return; /* We already found the hotkey table. */ - if (dm->type != 0xb2 || dm->length <= 6) + if (dm->type != 0xb2 || + dm->length <= sizeof(struct dell_bios_hotkey_table)) return; table = container_of(dm, struct dell_bios_hotkey_table, header); - hotkey_num = (table->header.length - 4) / + hotkey_num = (table->header.length - + sizeof(struct dell_bios_hotkey_table)) / sizeof(struct dell_bios_keymap_entry); keymap = kcalloc(hotkey_num + 1, sizeof(struct key_entry), GFP_KERNEL);