summaryrefslogtreecommitdiff
path: root/drivers/firmware
diff options
context:
space:
mode:
authorDoug Warzecha <Douglas_Warzecha@dell.com>2006-10-19 23:29:09 -0700
committerLinus Torvalds <torvalds@g5.osdl.org>2006-10-20 10:26:44 -0700
commitb95936cb9267e4c90a0b92361609ef5fd85a0a5f (patch)
treec6925759f6539a9f54fd20022a4f6bd79475cabc /drivers/firmware
parent1cd441f99819abdd2d919ff13e8c75af58a0fd9c (diff)
[PATCH] firmware/dcdbas: add size check in smi_data_write
Add a size check in smi_data_write to prevent possible wrapping problems with large pos values when calling smi_data_buf_realloc on 32-bit. Signed-off-by: Doug Warzecha <Douglas_Warzecha@dell.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/firmware')
-rw-r--r--drivers/firmware/dcdbas.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index 8bcb58cd4ac0..1865b56fb141 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -8,7 +8,7 @@
*
* See Documentation/dcdbas.txt for more information.
*
- * Copyright (C) 1995-2005 Dell Inc.
+ * Copyright (C) 1995-2006 Dell Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License v2.0 as published by
@@ -40,7 +40,7 @@
#include "dcdbas.h"
#define DRIVER_NAME "dcdbas"
-#define DRIVER_VERSION "5.6.0-2"
+#define DRIVER_VERSION "5.6.0-3.2"
#define DRIVER_DESCRIPTION "Dell Systems Management Base Driver"
static struct platform_device *dcdbas_pdev;
@@ -175,6 +175,9 @@ static ssize_t smi_data_write(struct kobject *kobj, char *buf, loff_t pos,
{
ssize_t ret;
+ if ((pos + count) > MAX_SMI_DATA_BUF_SIZE)
+ return -EINVAL;
+
mutex_lock(&smi_data_lock);
ret = smi_data_buf_realloc(pos + count);