leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

powerpc/spufs: Check file offset before calculating write size in fixed-sized files

Browse Source 
Based on an original patch from Roel Kluin <roel.kluin@gmail.com>.

The write size calculated during regs and fpcr writes may currently
go negative. Because size is unsigned, this will wrap, and our
check for EFBIG will fail.

Instead, do the check for EFBIG before subtracting from size.

Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
This commit is contained in:
Jeremy Kerr 2009-03-03 19:38:07 +00:00 committed by Benjamin Herrenschmidt
parent e7eec2fc27
commit d219889b76
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
arch/powerpc/platforms/cell/spufs/file.c
View File

@ -568,9 +568,10 @@ spufs_regs_write(struct file *file, const char __user *buffer,
struct spu_lscsa *lscsa = ctx->csa.lscsa;
int ret;
size = min_t(ssize_t, sizeof lscsa->gprs - *pos, size);
if (size <= 0)
if (*pos >= sizeof(lscsa->gprs))
return -EFBIG;
size = min_t(ssize_t, sizeof(lscsa->gprs) - *pos, size);
*pos += size;
ret = spu_acquire_saved(ctx);
@ -623,10 +624,11 @@ spufs_fpcr_write(struct file *file, const char __user * buffer,
struct spu_lscsa *lscsa = ctx->csa.lscsa;
int ret;
size = min_t(ssize_t, sizeof(lscsa->fpcr) - *pos, size);
if (size <= 0)
if (*pos >= sizeof(lscsa->fpcr))
return -EFBIG;
size = min_t(ssize_t, sizeof(lscsa->fpcr) - *pos, size);
ret = spu_acquire_saved(ctx);
if (ret)
return ret;