diff options
| author | Brian Norris <computersforpeace@gmail.com> | 2015-02-28 02:23:28 -0800 |
|---|---|---|
| committer | Sasha Levin <sasha.levin@oracle.com> | 2015-05-17 19:12:11 -0400 |
| commit | 054cf47d81e14bb77da7cc6eb72f317ac70440ed (patch) | |
| tree | dcb786cd41dd1de7876a4f7b514a77b3cddde5a7 /drivers/mtd | |
| parent | 256f3466548da7c3761e246dd5e6a0776c01df2a (diff) | |
UBI: fix check for "too many bytes"
[ Upstream commit 299d0c5b27346a77a0777c993372bf8777d4f2e5 ]
The comparison from the previous line seems to have been erroneously
(partially) copied-and-pasted onto the next. The second line should be
checking req.bytes, not req.lnum.
Coverity CID #139400
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
[rw: Fixed comparison]
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/ubi/cdev.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c index 59de69a24e40..3946d78e6a81 100644 --- a/drivers/mtd/ubi/cdev.c +++ b/drivers/mtd/ubi/cdev.c @@ -453,7 +453,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd, /* Validate the request */ err = -EINVAL; if (req.lnum < 0 || req.lnum >= vol->reserved_pebs || - req.bytes < 0 || req.lnum >= vol->usable_leb_size) + req.bytes < 0 || req.bytes > vol->usable_leb_size) break; err = get_exclusive(desc); |