Commit b95936cb authored by Doug Warzecha's avatar Doug Warzecha Committed by Linus Torvalds

[PATCH] firmware/dcdbas: add size check in smi_data_write

Add a size check in smi_data_write to prevent possible wrapping problems
with large pos values when calling smi_data_buf_realloc on 32-bit.
Signed-off-by: default avatarDoug Warzecha <Douglas_Warzecha@dell.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 1cd441f9
...@@ -8,7 +8,7 @@ ...@@ -8,7 +8,7 @@
* *
* See Documentation/dcdbas.txt for more information. * See Documentation/dcdbas.txt for more information.
* *
* Copyright (C) 1995-2005 Dell Inc. * Copyright (C) 1995-2006 Dell Inc.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License v2.0 as published by * it under the terms of the GNU General Public License v2.0 as published by
...@@ -40,7 +40,7 @@ ...@@ -40,7 +40,7 @@
#include "dcdbas.h" #include "dcdbas.h"
#define DRIVER_NAME "dcdbas" #define DRIVER_NAME "dcdbas"
#define DRIVER_VERSION "5.6.0-2" #define DRIVER_VERSION "5.6.0-3.2"
#define DRIVER_DESCRIPTION "Dell Systems Management Base Driver" #define DRIVER_DESCRIPTION "Dell Systems Management Base Driver"
static struct platform_device *dcdbas_pdev; static struct platform_device *dcdbas_pdev;
...@@ -175,6 +175,9 @@ static ssize_t smi_data_write(struct kobject *kobj, char *buf, loff_t pos, ...@@ -175,6 +175,9 @@ static ssize_t smi_data_write(struct kobject *kobj, char *buf, loff_t pos,
{ {
ssize_t ret; ssize_t ret;
if ((pos + count) > MAX_SMI_DATA_BUF_SIZE)
return -EINVAL;
mutex_lock(&smi_data_lock); mutex_lock(&smi_data_lock);
ret = smi_data_buf_realloc(pos + count); ret = smi_data_buf_realloc(pos + count);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment