diff options
| author | Ian Abbott | 2015-11-18 18:55:07 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2015-12-22 00:58:54 +0100 |
| commit | 591c5f8a599a58c7c3773027010e537fc1d7a7d5 (patch) | |
| tree | 13612d7e3c14fec4185ed0bc0b829bf3bef83b79 /drivers/staging/comedi/comedi_fops.c | |
| parent | staging: comedi: make some variables unsigned in comedi_write() (diff) | |
| download | kernel-qcow2-linux-591c5f8a599a58c7c3773027010e537fc1d7a7d5.tar.gz kernel-qcow2-linux-591c5f8a599a58c7c3773027010e537fc1d7a7d5.tar.xz kernel-qcow2-linux-591c5f8a599a58c7c3773027010e537fc1d7a7d5.zip | |
staging: comedi: avoid bad truncation of a size_t in comedi_write()
At one point in `comedi_write()`, the variable `n` gets assigned to the
minimum of the parameter `nbytes` and the amount of writeable buffer
space. The way that is done currently is unsafe in the unlikely case
that `nbytes` exceeds `UINT_MAX`, so fix it.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/comedi/comedi_fops.c')
| -rw-r--r-- | drivers/staging/comedi/comedi_fops.c | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c index 188a12a02ce7..8c784c483c3e 100644 --- a/drivers/staging/comedi/comedi_fops.c +++ b/drivers/staging/comedi/comedi_fops.c @@ -2357,16 +2357,13 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, break; } - n = nbytes; - - m = n; + /* Allocate all free buffer space. */ + comedi_buf_write_alloc(s, async->prealloc_bufsz); + m = comedi_buf_write_n_allocated(s); + /* Avoid buffer wraparound. */ if (async->buf_write_ptr + m > async->prealloc_bufsz) m = async->prealloc_bufsz - async->buf_write_ptr; - comedi_buf_write_alloc(s, async->prealloc_bufsz); - if (m > comedi_buf_write_n_allocated(s)) - m = comedi_buf_write_n_allocated(s); - if (m < n) - n = m; + n = min_t(size_t, m, nbytes); if (n == 0) { if (file->f_flags & O_NONBLOCK) { |