diff options
| author | Ingo Molnar <mingo@kernel.org> | 2024-01-26 10:26:50 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2024-01-26 10:26:50 +0100 |
| commit | 42ac0be18bfa09c03f52244f7c3e15c89b38532f (patch) | |
| tree | 601fd5e6da2ca0b77aa8cb22f0e81a29ba6fe1d6 /drivers/usb/misc/yurex.c | |
| parent | 8e5647a723c49d73b9f108a8bb38e8c29d3948ea (diff) | |
| parent | ecb1b8288dc7ccbdcb3b9df005fa1c0e0c0388a7 (diff) | |
Merge branch 'linus' into x86/mm, to refresh the branch and pick up fixes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/usb/misc/yurex.c')
| -rw-r--r-- | drivers/usb/misc/yurex.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c index c640f98d20c5..9a0649d23693 100644 --- a/drivers/usb/misc/yurex.c +++ b/drivers/usb/misc/yurex.c @@ -34,6 +34,8 @@ #define YUREX_BUF_SIZE 8 #define YUREX_WRITE_TIMEOUT (HZ*2) +#define MAX_S64_STRLEN 20 /* {-}922337203685477580{7,8} */ + /* table of devices that work with this driver */ static struct usb_device_id yurex_table[] = { { USB_DEVICE(YUREX_VENDOR_ID, YUREX_PRODUCT_ID) }, @@ -401,7 +403,7 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count, { struct usb_yurex *dev; int len = 0; - char in_buffer[20]; + char in_buffer[MAX_S64_STRLEN]; unsigned long flags; dev = file->private_data; @@ -412,14 +414,16 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count, return -ENODEV; } + if (WARN_ON_ONCE(dev->bbu > S64_MAX || dev->bbu < S64_MIN)) { + mutex_unlock(&dev->io_mutex); + return -EIO; + } + spin_lock_irqsave(&dev->lock, flags); - len = snprintf(in_buffer, 20, "%lld\n", dev->bbu); + scnprintf(in_buffer, MAX_S64_STRLEN, "%lld\n", dev->bbu); spin_unlock_irqrestore(&dev->lock, flags); mutex_unlock(&dev->io_mutex); - if (WARN_ON_ONCE(len >= sizeof(in_buffer))) - return -EIO; - return simple_read_from_buffer(buffer, count, ppos, in_buffer, len); } |