diff options
| author | David Fries <David@Fries.net> | 2014-11-10 21:19:37 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-11-26 22:09:01 -0500 |
| commit | 4b97b27939dd9b9ddbd4058efc96d45bc7163601 (patch) | |
| tree | 18a83e875711fb4ee38a413197d0766f241df178 | |
| parent | a30cfa475d1a26c18f1998ba1e034a4e2ab4c7a8 (diff) | |
w1: avoid potential u16 overflow
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: David Fries <David@Fries.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/w1/w1_netlink.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c index dd9656237274..881597a191b8 100644 --- a/drivers/w1/w1_netlink.c +++ b/drivers/w1/w1_netlink.c | |||
| @@ -598,7 +598,7 @@ static void w1_cn_callback(struct cn_msg *cn, struct netlink_skb_parms *nsp) | |||
| 598 | msg = (struct w1_netlink_msg *)(cn + 1); | 598 | msg = (struct w1_netlink_msg *)(cn + 1); |
| 599 | if (node_count) { | 599 | if (node_count) { |
| 600 | int size; | 600 | int size; |
| 601 | u16 reply_size = sizeof(*cn) + cn->len + slave_len; | 601 | int reply_size = sizeof(*cn) + cn->len + slave_len; |
| 602 | if (cn->flags & W1_CN_BUNDLE) { | 602 | if (cn->flags & W1_CN_BUNDLE) { |
| 603 | /* bundling duplicats some of the messages */ | 603 | /* bundling duplicats some of the messages */ |
| 604 | reply_size += 2 * cmd_count * (sizeof(struct cn_msg) + | 604 | reply_size += 2 * cmd_count * (sizeof(struct cn_msg) + |