* [patch -resend] paride: underflow bug in pg_write()
@ 2013-10-17 16:44 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2013-10-17 16:44 UTC (permalink / raw)
To: Tim Waugh, akpm; +Cc: linux-kernel, kernel-janitors
The test here can underflow so we pass bogus lengths to the hardware.
It's a static checker fix and I don't know the impact.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I sent this originally Jul 31, 2013 but there was no response.
diff --git a/drivers/block/paride/pg.c b/drivers/block/paride/pg.c
index 4a27b1d..2ce3dfd 100644
--- a/drivers/block/paride/pg.c
+++ b/drivers/block/paride/pg.c
@@ -581,7 +581,7 @@ static ssize_t pg_write(struct file *filp, const char __user *buf, size_t count,
if (hdr.magic != PG_MAGIC)
return -EINVAL;
- if (hdr.dlen > PG_MAX_DATA)
+ if (hdr.dlen < 0 || hdr.dlen > PG_MAX_DATA)
return -EINVAL;
if ((count - hs) > PG_MAX_DATA)
return -EINVAL;
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2013-10-17 16:44 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-17 16:44 [patch -resend] paride: underflow bug in pg_write() Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox