Patch "char: lp: fix possible integer overflow in lp_setup()" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

char: lp: fix possible integer overflow in lp_setup()

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
char-lp-fix-possible-integer-overflow-in-lp_setup.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Willy Tarreau <[email protected]>
Date: Tue, 16 May 2017 19:18:55 +0200
Subject: char: lp: fix possible integer overflow in lp_setup()

From: Willy Tarreau <[email protected]>

commit 3e21f4af170bebf47c187c1ff8bf155583c9f3b1 upstream.

The lp_setup() code doesn't apply any bounds checking when passing "lp=none", and only in this case, resulting in an overflow of the parport_nr[] array. All versions in Git history are affected.

---
 drivers/char/lp.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

@@ -859,7 +859,11 @@ static int __init lp_setup (char *str)
 	} else if (!strcmp(str, "auto")) {
 		parport_nr[0] = LP_PARPORT_AUTO;
 	} else if (!strcmp(str, "none")) {
-		parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+		if (parport_ptr < LP_NO)
+			parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+		else
+			printk(KERN_INFO "lp: too many ports, %s ignored.\n",
+			       str);
 	} else if (!strcmp(str, "reset")) {
 		reset = 1;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/char-lp-fix-possible-integer-overflow-in-lp_setup.patch