paride: underflow bug in pg_write()

PATCH New Dan Carpenter 1 participant 1 message Jul 31, 2013

Subsystems (2)

Block layer Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2013-07-31 09:08 UTC #0 lore raw

PATCH 1/1 paride: underflow bug in pg_write()

The test here can underflow so we pass bogus lengths to the hardware. It's a static checker fix and I don't know the impact.

Signed-off-by Dan Carpenter <[email protected]>

drivers/block/paride/pg.c +1 -1

index 4a27b1d..2ce3dfd 100644
@@ -581,7 +581,7 @@ static ssize_t pg_write(struct file *filp, const char __user *buf, size_t count,
 
 	if (hdr.magic != PG_MAGIC)
 		return -EINVAL;
-	if (hdr.dlen > PG_MAX_DATA)
+	if (hdr.dlen < 0 || hdr.dlen > PG_MAX_DATA)
 		return -EINVAL;
 	if ((count - hs) > PG_MAX_DATA)
 		return -EINVAL;