From 108e336f66d5a76fddb0682d20090d167200e838 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@infradead.org>
Date: Sat, 26 Sep 2009 20:51:50 +0200
Subject: [PATCH] --- yaml --- r: 167100 b: refs/heads/master c:
 11879ba5d9ab8174af9b9cefbb2396a54dfbf8c1 h: refs/heads/master v: v3

---
 [refs]                              |  2 +-
 trunk/arch/x86/kernel/cpu/mtrr/if.c | 17 ++++++++++++-----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/[refs] b/[refs]
index 72a740a8757f..9b8d60067748 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0d18b2e34bd1ad8f5bd3f3a17b5e7df132e511a9
+refs/heads/master: 11879ba5d9ab8174af9b9cefbb2396a54dfbf8c1
diff --git a/trunk/arch/x86/kernel/cpu/mtrr/if.c b/trunk/arch/x86/kernel/cpu/mtrr/if.c
index f04e72527604..3c1b12d461d1 100644
--- a/trunk/arch/x86/kernel/cpu/mtrr/if.c
+++ b/trunk/arch/x86/kernel/cpu/mtrr/if.c
@@ -96,17 +96,24 @@ mtrr_write(struct file *file, const char __user *buf, size_t len, loff_t * ppos)
 	unsigned long long base, size;
 	char *ptr;
 	char line[LINE_SIZE];
+	int length;
 	size_t linelen;
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
-	if (!len)
-		return -EINVAL;
 
 	memset(line, 0, LINE_SIZE);
-	if (len > LINE_SIZE)
-		len = LINE_SIZE;
-	if (copy_from_user(line, buf, len - 1))
+
+	length = len;
+	length--;
+
+	if (length > LINE_SIZE - 1)
+		length = LINE_SIZE - 1;
+
+	if (length < 0)
+		return -EINVAL;
+
+	if (copy_from_user(line, buf, length))
 		return -EFAULT;
 
 	linelen = strlen(line);