On Wed, Aug 12, 2015 at 07:50:25PM +0800, Kang Yin Su wrote:

On 12 August 2015 at 17:46, Alexander Shiyan [off-list ref] wrote:

quoted

quoted

Среда, 12 августа 2015, 15:36 +08:00 от cantona [off-list ref]:


added Alexander Shiyan < shc_work@mail.ru >.

On 12 August 2015 at 15:22, Su Kang Yin  < cantona@cantona.net > wrote:

quoted

Max310x driver supports up to 4 UART devices but array size of
"struct max310x_one" is set to 1. That leads to out of bounds
access on UART port registration.

This patch fixed it by increase the array size to 4 which is
maximum supported UART.

Signed-off-by: Su Kang Yin < cantona@cantona.net >
---

...

This seems incorrect. The number of ports is allocated dynamically by:
...
/* Alloc port structure */
s = devm_kzalloc(dev, sizeof(*s) + sizeof(struct max310x_one) * devtype->nr, GFP_KERNEL);
...

Thanks.

---

Oh, my bad.  But it looks confusing. So we must ensure "struct
max310x_one p[0]"  must the last element of "struct max310x_port".

Yes, that is a very common pattern we use in the kernel.