Skip to content

Commit

Permalink
drivers/block/paride/pg.c: underflow bug in pg_write()
Browse files Browse the repository at this point in the history
The test here can underflow so we pass bogus lengths to the hardware.
It's a static checker fix and I don't know the impact.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
  • Loading branch information
Dan Carpenter authored and Jens Axboe committed Jan 22, 2014
1 parent f2fc8af commit 3f7d758
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/block/paride/pg.c
Original file line number Diff line number Diff line change
Expand Up @@ -581,7 +581,7 @@ static ssize_t pg_write(struct file *filp, const char __user *buf, size_t count,

if (hdr.magic != PG_MAGIC)
return -EINVAL;
if (hdr.dlen > PG_MAX_DATA)
if (hdr.dlen < 0 || hdr.dlen > PG_MAX_DATA)
return -EINVAL;
if ((count - hs) > PG_MAX_DATA)
return -EINVAL;
Expand Down

0 comments on commit 3f7d758

Please sign in to comment.