Skip to contentSkip to conversation

powerpc/spufs: negative size in spufs_{regs/fpcr}_write

PATCH New Roel Kluin 2 participants 2 messages Mar 3, 2009 – Mar 4, 2009

Subsystems (3)
PowerPC Cell broadband engine architecture SPU file system
lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 powerpc/spufs: negative size in spufs_{regs/fpcr}_write

When stored in size_t size, the test 'size <= 0' does no longer work.

Signed-off-by Roel Kluin <[email protected]>

---

arch/powerpc/platforms/cell/spufs/file.c +2 -2
index 0da7f2b..05dba47 100644
@@ -569,7 +569,7 @@ spufs_regs_write(struct file *file, const char __user *buffer,
 	int ret;
 
 	size = min_t(ssize_t, sizeof lscsa->gprs - *pos, size);
-	if (size <= 0)
+	if ((ssize_t)size <= 0)
 		return -EFBIG;
 	*pos += size;
 

@@ -624,7 +624,7 @@ spufs_fpcr_write(struct file *file, const char __user * buffer,
 	int ret;
 
 	size = min_t(ssize_t, sizeof(lscsa->fpcr) - *pos, size);
-	if (size <= 0)
+	if ((ssize_t)size <= 0)
 		return -EFBIG;
 
 	ret = spu_acquire_saved(ctx);
#1 lore raw

PATCH 1/1 powerpc/spufs: Check file offset before calculating write size in fixed-sized files

Based on an original patch from Roel Kluin <[email protected]>.

The write size calculated during regs and fpcr writes may currently go negative. Because size is unsigned, this will wrap, and our check for EFBIG will fail.

Instead, do the check for EFBIG before subtracting from size.

Signed-off-by Jeremy Kerr <[email protected]>

---
Roel - How about this? clear up the logic a little rather than casting

---
 arch/powerpc/platforms/cell/spufs/file.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
arch/powerpc/platforms/cell/spufs/file.c +6 -4
index 0da7f2b..83ef889 100644
@@ -568,9 +568,10 @@ spufs_regs_write(struct file *file, const char __user *buffer,
 	struct spu_lscsa *lscsa = ctx->csa.lscsa;
 	int ret;
 
-	size = min_t(ssize_t, sizeof lscsa->gprs - *pos, size);
-	if (size <= 0)
+	if (*pos >= sizeof(lscsa->gprs))
 		return -EFBIG;
+
+	size = min_t(ssize_t, sizeof(lscsa->gprs) - *pos, size);
 	*pos += size;
 
 	ret = spu_acquire_saved(ctx);

@@ -623,10 +624,11 @@ spufs_fpcr_write(struct file *file, const char __user * buffer,
 	struct spu_lscsa *lscsa = ctx->csa.lscsa;
 	int ret;
 
-	size = min_t(ssize_t, sizeof(lscsa->fpcr) - *pos, size);
-	if (size <= 0)
+	if (*pos >= sizeof(lscsa->fpcr))
 		return -EFBIG;
 
+	size = min_t(ssize_t, sizeof(lscsa->fpcr) - *pos, size);
+
 	ret = spu_acquire_saved(ctx);
 	if (ret)
 		return ret;