From 3ce41606d99a7984da41aaae6c0a6b0bb5a3df33 Mon Sep 17 00:00:00 2001 From: Hannes Reinecke Date: Tue, 9 Mar 2010 10:18:48 +0100 Subject: [PATCH] --- yaml --- r: 195542 b: refs/heads/master c: 36dd288f0f930c154ec6a4d73a6a35f3079418c6 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/drivers/scsi/scsi_transport_fc.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/[refs] b/[refs] index 639c88378117..05203d03682f 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: bb789d01620e5d36081b22edb6fb71cf55ff043c +refs/heads/master: 36dd288f0f930c154ec6a4d73a6a35f3079418c6 diff --git a/trunk/drivers/scsi/scsi_transport_fc.c b/trunk/drivers/scsi/scsi_transport_fc.c index 6cfffc88022a..55fe730a8606 100644 --- a/trunk/drivers/scsi/scsi_transport_fc.c +++ b/trunk/drivers/scsi/scsi_transport_fc.c @@ -834,7 +834,7 @@ static ssize_t store_fc_rport_dev_loss_tmo(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { - int val; + unsigned long val; struct fc_rport *rport = transport_class_to_rport(dev); struct Scsi_Host *shost = rport_to_shost(rport); struct fc_internal *i = to_fc_internal(shost->transportt); @@ -847,6 +847,12 @@ store_fc_rport_dev_loss_tmo(struct device *dev, struct device_attribute *attr, if ((*cp && (*cp != '\n')) || (val < 0)) return -EINVAL; + /* + * Check for overflow; dev_loss_tmo is u32 + */ + if (val > UINT_MAX) + return -EINVAL; + /* * If fast_io_fail is off we have to cap * dev_loss_tmo at SCSI_DEVICE_BLOCK_MAX_TIMEOUT @@ -2865,7 +2871,7 @@ void fc_remote_port_delete(struct fc_rport *rport) { struct Scsi_Host *shost = rport_to_shost(rport); - int timeout = rport->dev_loss_tmo; + unsigned long timeout = rport->dev_loss_tmo; unsigned long flags; /*