提交 d219889b 编写于 作者: J Jeremy Kerr 提交者: Benjamin Herrenschmidt

powerpc/spufs: Check file offset before calculating write size in fixed-sized files

Based on an original patch from Roel Kluin <roel.kluin@gmail.com>.

The write size calculated during regs and fpcr writes may currently
go negative. Because size is unsigned, this will wrap, and our
check for EFBIG will fail.

Instead, do the check for EFBIG before subtracting from size.
Signed-off-by: NJeremy Kerr <jk@ozlabs.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
上级 e7eec2fc
......@@ -568,9 +568,10 @@ spufs_regs_write(struct file *file, const char __user *buffer,
struct spu_lscsa *lscsa = ctx->csa.lscsa;
int ret;
size = min_t(ssize_t, sizeof lscsa->gprs - *pos, size);
if (size <= 0)
if (*pos >= sizeof(lscsa->gprs))
return -EFBIG;
size = min_t(ssize_t, sizeof(lscsa->gprs) - *pos, size);
*pos += size;
ret = spu_acquire_saved(ctx);
......@@ -623,10 +624,11 @@ spufs_fpcr_write(struct file *file, const char __user * buffer,
struct spu_lscsa *lscsa = ctx->csa.lscsa;
int ret;
size = min_t(ssize_t, sizeof(lscsa->fpcr) - *pos, size);
if (size <= 0)
if (*pos >= sizeof(lscsa->fpcr))
return -EFBIG;
size = min_t(ssize_t, sizeof(lscsa->fpcr) - *pos, size);
ret = spu_acquire_saved(ctx);
if (ret)
return ret;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册