diff options
| author | Stephen Rothwell <sfr@canb.auug.org.au> | 2013-03-07 14:29:23 +1100 |
|---|---|---|
| committer | Stephen Rothwell <sfr@canb.auug.org.au> | 2013-03-07 14:29:23 +1100 |
| commit | 30c4fbf7e3977ec8c2966a633cd281b44e3a63fd (patch) | |
| tree | b8d7dc9ac82e3f179d886311a6b73c9c5c52c35d /drivers/message/i2o/i2o_config.c | |
| parent | 725a7c316ea0d1329b630e31f82d0a2e762e0a65 (diff) | |
| parent | df2363d9ad7ffd43b5e86604c7a28f4adc6bd75e (diff) | |
Merge branch 'akpm/master'
Diffstat (limited to 'drivers/message/i2o/i2o_config.c')
| -rw-r--r-- | drivers/message/i2o/i2o_config.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c index 5451beff183f..a60c188c2bd9 100644 --- a/drivers/message/i2o/i2o_config.c +++ b/drivers/message/i2o/i2o_config.c @@ -687,6 +687,11 @@ static int i2o_cfg_passthru32(struct file *file, unsigned cmnd, } size = size >> 16; size *= 4; + if (size > sizeof(rmsg)) { + rcode = -EINVAL; + goto sg_list_cleanup; + } + /* Copy in the user's I2O command */ if (copy_from_user(rmsg, user_msg, size)) { rcode = -EFAULT; @@ -922,6 +927,11 @@ static int i2o_cfg_passthru(unsigned long arg) } size = size >> 16; size *= 4; + if (size > sizeof(rmsg)) { + rcode = -EFAULT; + goto sg_list_cleanup; + } + /* Copy in the user's I2O command */ if (copy_from_user(rmsg, user_msg, size)) { rcode = -EFAULT; |