diff options
| author |   Doug Warzecha <Douglas_Warzecha@dell.com> | 2006-10-19 23:29:09 -0700 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@g5.osdl.org> | 2006-10-20 10:26:44 -0700 |
| commit | b95936cb9267e4c90a0b92361609ef5fd85a0a5f (patch) | |
| tree | c6925759f6539a9f54fd20022a4f6bd79475cabc /drivers/firmware | |
| parent | [PATCH] ipmi: fix return codes in failure case (diff) | |
| download | linux-dev-b95936cb9267e4c90a0b92361609ef5fd85a0a5f.tar.xz linux-dev-b95936cb9267e4c90a0b92361609ef5fd85a0a5f.zip | |
[PATCH] firmware/dcdbas: add size check in smi_data_write
Add a size check in smi_data_write to prevent possible wrapping problems
with large pos values when calling smi_data_buf_realloc on 32-bit.
Signed-off-by: Doug Warzecha <Douglas_Warzecha@dell.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/firmware')
| -rw-r--r-- | drivers/firmware/dcdbas.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c index 8bcb58cd4ac0..1865b56fb141 100644 --- a/drivers/firmware/dcdbas.c +++ b/drivers/firmware/dcdbas.c @@ -8,7 +8,7 @@ * * See Documentation/dcdbas.txt for more information. * - * Copyright (C) 1995-2005 Dell Inc. + * Copyright (C) 1995-2006 Dell Inc. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License v2.0 as published by @@ -40,7 +40,7 @@ #include "dcdbas.h" #define DRIVER_NAME "dcdbas" -#define DRIVER_VERSION "5.6.0-2" +#define DRIVER_VERSION "5.6.0-3.2" #define DRIVER_DESCRIPTION "Dell Systems Management Base Driver" static struct platform_device *dcdbas_pdev; @@ -175,6 +175,9 @@ static ssize_t smi_data_write(struct kobject *kobj, char *buf, loff_t pos, { ssize_t ret; + if ((pos + count) > MAX_SMI_DATA_BUF_SIZE) + return -EINVAL; + mutex_lock(&smi_data_lock); ret = smi_data_buf_realloc(pos + count); |