PCI: Check dynids driver_data value for validity

[safe/jmp/linux-2.6] / drivers / pci / pci-driver.c

diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 4940a53..b4cdd69 100644 (file)
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -43,18 +43,32 @@ store_new_id(struct device_driver *driver, const char *buf, size_t count)
 {
        struct pci_dynid *dynid;
        struct pci_driver *pdrv = to_pci_driver(driver);
+       const struct pci_device_id *ids = pdrv->id_table;
        __u32 vendor, device, subvendor=PCI_ANY_ID,
                subdevice=PCI_ANY_ID, class=0, class_mask=0;
        unsigned long driver_data=0;
        int fields=0;
-       int retval = 0;
+       int retval;
 
-       fields = sscanf(buf, "%x %x %x %x %x %x %lux",
+       fields = sscanf(buf, "%x %x %x %x %x %x %lx",
                        &vendor, &device, &subvendor, &subdevice,
                        &class, &class_mask, &driver_data);
        if (fields < 2)
                return -EINVAL;
 
+       /* Only accept driver_data values that match an existing id_table
+          entry */
+       retval = -EINVAL;
+       while (ids->vendor || ids->subvendor || ids->class_mask) {
+               if (driver_data == ids->driver_data) {
+                       retval = 0;
+                       break;
+               }
+               ids++;
+       }
+       if (retval)     /* No match */
+               return retval;
+
        dynid = kzalloc(sizeof(*dynid), GFP_KERNEL);
        if (!dynid)
                return -ENOMEM;