From da90fa8ff671a0139772ec3b3e82c06077e82122 Mon Sep 17 00:00:00 2001 From: Domen Puncer Date: Wed, 23 May 2007 13:57:39 -0700 Subject: spi/spidev: check message size before copying Message size needs to be checked before copying, or bad things could happen. Signed-off-by: Domen Puncer Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/spi/spidev.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'drivers/spi/spidev.c') diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c index 225d6b2f82dd..bcfef04f547e 100644 --- a/drivers/spi/spidev.c +++ b/drivers/spi/spidev.c @@ -168,6 +168,12 @@ static int spidev_message(struct spidev_data *spidev, n--, k_tmp++, u_tmp++) { k_tmp->len = u_tmp->len; + total += k_tmp->len; + if (total > bufsiz) { + status = -EMSGSIZE; + goto done; + } + if (u_tmp->rx_buf) { k_tmp->rx_buf = buf; if (!access_ok(VERIFY_WRITE, u_tmp->rx_buf, u_tmp->len)) @@ -179,12 +185,6 @@ static int spidev_message(struct spidev_data *spidev, u_tmp->len)) goto done; } - - total += k_tmp->len; - if (total > bufsiz) { - status = -EMSGSIZE; - goto done; - } buf += k_tmp->len; k_tmp->cs_change = !!u_tmp->cs_change; -- cgit v1.2.2