|
@@ -31,6 +31,7 @@
|
|
#include <linux/slab.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/list.h>
|
|
#include <linux/list.h>
|
|
#include <linux/module.h>
|
|
#include <linux/module.h>
|
|
|
|
+#include <linux/nospec.h>
|
|
#include <linux/vmalloc.h>
|
|
#include <linux/vmalloc.h>
|
|
#include <linux/delay.h>
|
|
#include <linux/delay.h>
|
|
#include <linux/spinlock.h>
|
|
#include <linux/spinlock.h>
|
|
@@ -1476,6 +1477,7 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
|
|
|
|
|
|
if (slot >= ca->slot_count)
|
|
if (slot >= ca->slot_count)
|
|
return -EINVAL;
|
|
return -EINVAL;
|
|
|
|
+ slot = array_index_nospec(slot, ca->slot_count);
|
|
sl = &ca->slot_info[slot];
|
|
sl = &ca->slot_info[slot];
|
|
|
|
|
|
/* check if the slot is actually running */
|
|
/* check if the slot is actually running */
|