diff options
author | Sebastian Ott <sebott@linux.vnet.ibm.com> | 2009-03-26 10:24:16 -0400 |
---|---|---|
committer | Martin Schwidefsky <schwidefsky@de.ibm.com> | 2009-03-26 10:24:16 -0400 |
commit | 94cbc203bee4ea87bd49ad56f6c5381bc10d8b6b (patch) | |
tree | 0ca9d98b1137056d783b25bf8a5d1f69b2ff7a47 /drivers/s390/cio | |
parent | e909074bb91773680c0b2e49ea8af9f85c6f59bd (diff) |
[S390] cio: fix wrong buffer access in cio_ignore_write
Writing only spaces to /proc/cio_ignore will cause a buffer overflow
since the size_t value i will not become negative and so buf[-1UL] is
accessed. Change the value of i to ssize_t.
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Diffstat (limited to 'drivers/s390/cio')
-rw-r--r-- | drivers/s390/cio/blacklist.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c index fe00be3675cd..6565f027791e 100644 --- a/drivers/s390/cio/blacklist.c +++ b/drivers/s390/cio/blacklist.c | |||
@@ -336,8 +336,7 @@ cio_ignore_write(struct file *file, const char __user *user_buf, | |||
336 | size_t user_len, loff_t *offset) | 336 | size_t user_len, loff_t *offset) |
337 | { | 337 | { |
338 | char *buf; | 338 | char *buf; |
339 | size_t i; | 339 | ssize_t rc, ret, i; |
340 | ssize_t rc, ret; | ||
341 | 340 | ||
342 | if (*offset) | 341 | if (*offset) |
343 | return -EINVAL; | 342 | return -EINVAL; |