aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorSebastian Ott <sebott@linux.vnet.ibm.com>2009-03-26 10:24:16 -0400
committerMartin Schwidefsky <schwidefsky@de.ibm.com>2009-03-26 10:24:16 -0400
commit94cbc203bee4ea87bd49ad56f6c5381bc10d8b6b (patch)
tree0ca9d98b1137056d783b25bf8a5d1f69b2ff7a47 /drivers
parente909074bb91773680c0b2e49ea8af9f85c6f59bd (diff)
[S390] cio: fix wrong buffer access in cio_ignore_write
Writing only spaces to /proc/cio_ignore will cause a buffer overflow since the size_t value i will not become negative and so buf[-1UL] is accessed. Change the value of i to ssize_t. Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/s390/cio/blacklist.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c
index fe00be3675cd..6565f027791e 100644
--- a/drivers/s390/cio/blacklist.c
+++ b/drivers/s390/cio/blacklist.c
@@ -336,8 +336,7 @@ cio_ignore_write(struct file *file, const char __user *user_buf,
336 size_t user_len, loff_t *offset) 336 size_t user_len, loff_t *offset)
337{ 337{
338 char *buf; 338 char *buf;
339 size_t i; 339 ssize_t rc, ret, i;
340 ssize_t rc, ret;
341 340
342 if (*offset) 341 if (*offset)
343 return -EINVAL; 342 return -EINVAL;