* [PATCH] ide-cd: unsigned len subtracted below 0?
@ 2009-03-03 23:13 Roel Kluin
2009-03-04 7:20 ` Borislav Petkov
0 siblings, 1 reply; 2+ messages in thread
From: Roel Kluin @ 2009-03-03 23:13 UTC (permalink / raw)
To: Borislav Petkov; +Cc: linux-ide, Andrew Morton
len is unsigned, so take care not to subtract below 0.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index ddfbea4..23447a0 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -916,7 +916,10 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
xferfunc(drive, NULL, ptr, blen);
thislen -= blen;
- len -= blen;
+ if (blen > len)
+ len -= blen;
+ else
+ len = 0;
if (blk_fs_request(rq)) {
rq->buffer += blen;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ide-cd: unsigned len subtracted below 0?
2009-03-03 23:13 [PATCH] ide-cd: unsigned len subtracted below 0? Roel Kluin
@ 2009-03-04 7:20 ` Borislav Petkov
0 siblings, 0 replies; 2+ messages in thread
From: Borislav Petkov @ 2009-03-04 7:20 UTC (permalink / raw)
To: Roel Kluin; +Cc: linux-ide, Andrew Morton
On Wed, Mar 04, 2009 at 12:13:46AM +0100, Roel Kluin wrote:
> len is unsigned, so take care not to subtract below 0.
>
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> ---
> diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
> index ddfbea4..23447a0 100644
> --- a/drivers/ide/ide-cd.c
> +++ b/drivers/ide/ide-cd.c
> @@ -916,7 +916,10 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
> xferfunc(drive, NULL, ptr, blen);
>
> thislen -= blen;
> - len -= blen;
> + if (blen > len)
> + len -= blen;
> + else
> + len = 0;
Hi,
can you please look at the code and try to understand what it does.
Especially the part where thislen is being initialized:
thislen = blk_fs_request(rq) ? len : cmd->nleft;
if (thislen > len)
thislen = len;
now look at the loop where len is being decremented. Question: can len
really wrap?
>
> if (blk_fs_request(rq)) {
> rq->buffer += blen;
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-03-04 7:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-03-03 23:13 [PATCH] ide-cd: unsigned len subtracted below 0? Roel Kluin
2009-03-04 7:20 ` Borislav Petkov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).