Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

[MTD] slram: Handle negative devlength correctly

A negative devlength won't get noticed and clean up:

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

authored by

Roel Kluin and committed by
David Woodhouse
3afd522d 5f877607

+10 -4
+10 -4
drivers/mtd/devices/slram.c
··· 267 267 if (*(szlength) != '+') { 268 268 devlength = simple_strtoul(szlength, &buffer, 0); 269 269 devlength = handle_unit(devlength, buffer) - devstart; 270 + if (devlength < devstart) 271 + goto err_out; 272 + 273 + devlength -= devstart; 270 274 } else { 271 275 devlength = simple_strtoul(szlength + 1, &buffer, 0); 272 276 devlength = handle_unit(devlength, buffer); 273 277 } 274 278 T("slram: devname=%s, devstart=0x%lx, devlength=0x%lx\n", 275 279 devname, devstart, devlength); 276 - if ((devstart < 0) || (devlength < 0) || (devlength % SLRAM_BLK_SZ != 0)) { 277 - E("slram: Illegal start / length parameter.\n"); 278 - return(-EINVAL); 279 - } 280 + if (devlength % SLRAM_BLK_SZ != 0) 281 + goto err_out; 280 282 281 283 if ((devstart = register_device(devname, devstart, devlength))){ 282 284 unregister_devices(); 283 285 return((int)devstart); 284 286 } 285 287 return(0); 288 + 289 + err_out: 290 + E("slram: Illegal length parameter.\n"); 291 + return(-EINVAL); 286 292 } 287 293 288 294 #ifndef MODULE