uio: fix allocating minor id for uio device

The number of uio devices that could be used should be less than
UIO_MAX_DEVICES by design, and this work guards any cases in which id
more than UIO_MAX_DEVICES is utilized.

Signed-off-by: Hillf Danton <dhillf@gmail.com>
Signed-off-by: Hans J. Koch <hjk@hansjkoch.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 10a029b24159a818e4bf4c83f8ae0bdc2b926524..d2efe823c20dd7fc317a1ffc0e12c283138e531d 100644 (file)
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -381,7 +381,13 @@ static int uio_get_minor(struct uio_device *idev)
                        retval = -ENOMEM;
                goto exit;
        }
-       idev->minor = id & MAX_ID_MASK;
+       if (id < UIO_MAX_DEVICES) {
+               idev->minor = id;
+       } else {
+               dev_err(idev->dev, "too many uio devices\n");
+               retval = -EINVAL;
+               idr_remove(&uio_idr, id);
+       }
 exit:
        mutex_unlock(&minor_lock);
        return retval;