uio: fix allocating minor id for uio device
Hillf Danton [Thu, 31 Mar 2011 12:38:47 +0000 (20:38 +0800)]
The number of uio devices that could be used should be less than
UIO_MAX_DEVICES by design, and this work guards any cases in which id
more than UIO_MAX_DEVICES is utilized.

Signed-off-by: Hillf Danton <dhillf@gmail.com>
Signed-off-by: Hans J. Koch <hjk@hansjkoch.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/uio/uio.c

index 10a029b..d2efe82 100644 (file)
@@ -381,7 +381,13 @@ static int uio_get_minor(struct uio_device *idev)
                        retval = -ENOMEM;
                goto exit;
        }
-       idev->minor = id & MAX_ID_MASK;
+       if (id < UIO_MAX_DEVICES) {
+               idev->minor = id;
+       } else {
+               dev_err(idev->dev, "too many uio devices\n");
+               retval = -EINVAL;
+               idr_remove(&uio_idr, id);
+       }
 exit:
        mutex_unlock(&minor_lock);
        return retval;