diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-01-21 17:39:22 -0500 |
---|---|---|
committer | Jens Axboe <axboe@kernel.dk> | 2014-01-21 23:16:56 -0500 |
commit | 3f7d758b1e3c18360f955d1d5e224865c5e0b881 (patch) | |
tree | 34ceec2d6341be4d8668a257b9931c0271824431 /drivers/block/paride/pg.c | |
parent | f2fc8af41c351d11dcdd863356ff31fccf86cfed (diff) |
drivers/block/paride/pg.c: underflow bug in pg_write()
The test here can underflow so we pass bogus lengths to the hardware.
It's a static checker fix and I don't know the impact.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'drivers/block/paride/pg.c')
-rw-r--r-- | drivers/block/paride/pg.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/block/paride/pg.c b/drivers/block/paride/pg.c index 4a27b1de5fcb..2ce3dfd7e6b9 100644 --- a/drivers/block/paride/pg.c +++ b/drivers/block/paride/pg.c | |||
@@ -581,7 +581,7 @@ static ssize_t pg_write(struct file *filp, const char __user *buf, size_t count, | |||
581 | 581 | ||
582 | if (hdr.magic != PG_MAGIC) | 582 | if (hdr.magic != PG_MAGIC) |
583 | return -EINVAL; | 583 | return -EINVAL; |
584 | if (hdr.dlen > PG_MAX_DATA) | 584 | if (hdr.dlen < 0 || hdr.dlen > PG_MAX_DATA) |
585 | return -EINVAL; | 585 | return -EINVAL; |
586 | if ((count - hs) > PG_MAX_DATA) | 586 | if ((count - hs) > PG_MAX_DATA) |
587 | return -EINVAL; | 587 | return -EINVAL; |