Commit 3f7d758b authored by Dan Carpenter's avatar Dan Carpenter Committed by Jens Axboe

drivers/block/paride/pg.c: underflow bug in pg_write()

The test here can underflow so we pass bogus lengths to the hardware.
It's a static checker fix and I don't know the impact.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent f2fc8af4
...@@ -581,7 +581,7 @@ static ssize_t pg_write(struct file *filp, const char __user *buf, size_t count, ...@@ -581,7 +581,7 @@ static ssize_t pg_write(struct file *filp, const char __user *buf, size_t count,
if (hdr.magic != PG_MAGIC) if (hdr.magic != PG_MAGIC)
return -EINVAL; return -EINVAL;
if (hdr.dlen > PG_MAX_DATA) if (hdr.dlen < 0 || hdr.dlen > PG_MAX_DATA)
return -EINVAL; return -EINVAL;
if ((count - hs) > PG_MAX_DATA) if ((count - hs) > PG_MAX_DATA)
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment