]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift
authorIan Abbott <abbotti@mev.co.uk>
Fri, 17 Jul 2020 14:52:57 +0000 (15:52 +0100)
committerKhalid Elmously <khalid.elmously@canonical.com>
Sat, 8 Aug 2020 05:53:12 +0000 (01:53 -0400)
commit99492e1a6a7b7ec64fc72d1a0e5dc860f58e8df5
tree2df9e05c3a9b8045854753101b3bb9d09bb78c88
parent33931b8247647e75c1caeeb49a0cd58a15162780
staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift

BugLink: https://bugs.launchpad.net/bugs/1889669
commit fc846e9db67c7e808d77bf9e2ef3d49e3820ce5d upstream.

The `INSN_CONFIG` comedi instruction with sub-instruction code
`INSN_CONFIG_DIGITAL_TRIG` includes a base channel in `data[3]`. This is
used as a right shift amount for other bitmask values without being
checked.  Shift amounts greater than or equal to 32 will result in
undefined behavior.  Add code to deal with this, adjusting the checks
for invalid channels so that enabled channel bits that would have been
lost by shifting are also checked for validity.  Only channels 0 to 15
are valid.

Fixes: a8c66b684efaf ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
Cc: <stable@vger.kernel.org> #4.0+: ef75e14a6c93: staging: comedi: verify array index is correct before using it
Cc: <stable@vger.kernel.org> #4.0+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20200717145257.112660-5-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kelsey Skunberg <kelsey.skunberg@canonical.com>
drivers/staging/comedi/drivers/addi_apci_1500.c