diff options
| author | Domen Puncer <domen.puncer@telargo.com> | 2007-05-23 13:57:39 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-05-23 20:14:12 -0700 |
| commit | da90fa8ff671a0139772ec3b3e82c06077e82122 (patch) | |
| tree | bf648a91c12174ec0bd32a013cdfc63d62f70753 | |
| parent | b7add02d6247bff34005e040347d81777c80931c (diff) | |
| download | linux-da90fa8ff671a0139772ec3b3e82c06077e82122.tar.gz linux-da90fa8ff671a0139772ec3b3e82c06077e82122.tar.bz2 linux-da90fa8ff671a0139772ec3b3e82c06077e82122.zip | |
spi/spidev: check message size before copying
Message size needs to be checked before copying, or bad things could
happen.
Signed-off-by: Domen Puncer <domen.puncer@telargo.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | drivers/spi/spidev.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c index 225d6b2f82dd..bcfef04f547e 100644 --- a/drivers/spi/spidev.c +++ b/drivers/spi/spidev.c @@ -168,6 +168,12 @@ static int spidev_message(struct spidev_data *spidev, n--, k_tmp++, u_tmp++) { k_tmp->len = u_tmp->len; + total += k_tmp->len; + if (total > bufsiz) { + status = -EMSGSIZE; + goto done; + } + if (u_tmp->rx_buf) { k_tmp->rx_buf = buf; if (!access_ok(VERIFY_WRITE, u_tmp->rx_buf, u_tmp->len)) @@ -179,12 +185,6 @@ static int spidev_message(struct spidev_data *spidev, u_tmp->len)) goto done; } - - total += k_tmp->len; - if (total > bufsiz) { - status = -EMSGSIZE; - goto done; - } buf += k_tmp->len; k_tmp->cs_change = !!u_tmp->cs_change; |