diff options
| author | Dave Jones <davej@redhat.com> | 2006-12-12 17:41:41 -0500 |
|---|---|---|
| committer | Dave Jones <davej@redhat.com> | 2006-12-12 17:41:41 -0500 |
| commit | c4366889dda8110247be59ca41fddb82951a8c26 (patch) | |
| tree | 705c1a996bed8fd48ce94ff33ec9fd00f9b94875 /drivers/ide/ide-taskfile.c | |
| parent | db2fb9db5735cc532fd4fc55e94b9a3c3750378e (diff) | |
| parent | e1036502e5263851259d147771226161e5ccc85a (diff) | |
| download | lwn-c4366889dda8110247be59ca41fddb82951a8c26.tar.gz lwn-c4366889dda8110247be59ca41fddb82951a8c26.zip | |
Merge ../linus
Conflicts:
drivers/cpufreq/cpufreq.c
Diffstat (limited to 'drivers/ide/ide-taskfile.c')
| -rw-r--r-- | drivers/ide/ide-taskfile.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c index 1d0470c1f957..30175c7688e8 100644 --- a/drivers/ide/ide-taskfile.c +++ b/drivers/ide/ide-taskfile.c @@ -524,8 +524,8 @@ int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg) task_ioreg_t *hobsptr = args.hobRegister; int err = 0; int tasksize = sizeof(struct ide_task_request_s); - int taskin = 0; - int taskout = 0; + unsigned int taskin = 0; + unsigned int taskout = 0; u8 io_32bit = drive->io_32bit; char __user *buf = (char __user *)arg; @@ -538,8 +538,13 @@ int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg) return -EFAULT; } - taskout = (int) req_task->out_size; - taskin = (int) req_task->in_size; + taskout = req_task->out_size; + taskin = req_task->in_size; + + if (taskin > 65536 || taskout > 65536) { + err = -EINVAL; + goto abort; + } if (taskout) { int outtotal = tasksize; |