* [PATCH] staging: unisys: visorchannel_write() fix potential memory corruption
@ 2015-06-16 13:13 Benjamin Romer
0 siblings, 0 replies; only message in thread
From: Benjamin Romer @ 2015-06-16 13:13 UTC (permalink / raw)
To: gregkh; +Cc: Jes.Sorensen, sparmaintainer, driverdev-devel, Benjamin Romer
From: Jes Sorensen <Jes.Sorensen@redhat.com>
This fixes the memory corruption case, if nbytes is less than offset
and sizeof(struct channel_header)
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Benjamin Romer <benjamin.romer@unisys.com>
---
drivers/staging/unisys/visorbus/visorchannel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/unisys/visorbus/visorchannel.c b/drivers/staging/unisys/visorbus/visorchannel.c
index b1155ab..20b6349 100644
--- a/drivers/staging/unisys/visorbus/visorchannel.c
+++ b/drivers/staging/unisys/visorbus/visorchannel.c
@@ -258,7 +258,7 @@ visorchannel_write(struct visorchannel *channel, ulong offset,
return -EIO;
if (offset < chdr_size) {
- copy_size = min(chdr_size, nbytes) - offset;
+ copy_size = min(chdr_size - offset, nbytes);
memcpy(&channel->chan_hdr + offset, local, copy_size);
}
--
2.1.4
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2015-06-16 13:14 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-06-16 13:13 [PATCH] staging: unisys: visorchannel_write() fix potential memory corruption Benjamin Romer
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.