diff options
author | Linus Torvalds <torvalds@g5.osdl.org> | 2006-01-04 19:20:40 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-01-04 19:20:40 -0500 |
commit | e28cc71572da38a5a12c1cfe4d7032017adccf69 (patch) | |
tree | bea9af22a98ea2988a38f5e9fc2467ccbbf3ae70 /arch/mips/kernel/linux32.c | |
parent | a020ff412f0ecbb1e4aae1681b287e5785dd77b5 (diff) |
Relax the rw_verify_area() error checking.
In particular, allow over-large read- or write-requests to be downgraded
to a more reasonable range, rather than considering them outright errors.
We want to protect lower layers from (the sadly all too common) overflow
conditions, but prefer to do so by chopping the requests up, rather than
just refusing them outright.
Cc: Peter Anvin <hpa@zytor.com>
Cc: Ulrich Drepper <drepper@redhat.com>
Cc: Andi Kleen <ak@suse.de>
Cc: Al Viro <viro@ftp.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'arch/mips/kernel/linux32.c')
-rw-r--r-- | arch/mips/kernel/linux32.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c index 330cf84d21fe..60353f5acc48 100644 --- a/arch/mips/kernel/linux32.c +++ b/arch/mips/kernel/linux32.c | |||
@@ -420,7 +420,7 @@ asmlinkage ssize_t sys32_pread(unsigned int fd, char * buf, | |||
420 | goto out; | 420 | goto out; |
421 | pos = merge_64(a4, a5); | 421 | pos = merge_64(a4, a5); |
422 | ret = rw_verify_area(READ, file, &pos, count); | 422 | ret = rw_verify_area(READ, file, &pos, count); |
423 | if (ret) | 423 | if (ret < 0) |
424 | goto out; | 424 | goto out; |
425 | ret = -EINVAL; | 425 | ret = -EINVAL; |
426 | if (!file->f_op || !(read = file->f_op->read)) | 426 | if (!file->f_op || !(read = file->f_op->read)) |
@@ -455,7 +455,7 @@ asmlinkage ssize_t sys32_pwrite(unsigned int fd, const char * buf, | |||
455 | goto out; | 455 | goto out; |
456 | pos = merge_64(a4, a5); | 456 | pos = merge_64(a4, a5); |
457 | ret = rw_verify_area(WRITE, file, &pos, count); | 457 | ret = rw_verify_area(WRITE, file, &pos, count); |
458 | if (ret) | 458 | if (ret < 0) |
459 | goto out; | 459 | goto out; |
460 | ret = -EINVAL; | 460 | ret = -EINVAL; |
461 | if (!file->f_op || !(write = file->f_op->write)) | 461 | if (!file->f_op || !(write = file->f_op->write)) |