Messages in this thread Patch in this message | | | From | Peter Rosin <> | Subject | [PATCH v10 11/11] iio: multiplexer: fix unsigned check with less than zero | Date | Fri, 10 Mar 2017 12:10:05 +0100 |
| |
Comparing a size_t with less than zero is always false as size_t is unsigned. So, change the type of the variable to ssize_t and replicate the size check from mux_configure_channel() into mux_write_ext_info() thus ensuring that the size will fit in the ssize_t variable.
Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0")
Reported-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Peter Rosin <peda@axentia.se> --- drivers/iio/multiplexer/iio-mux.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c index 94d40f9bef4c..bab9e6902090 100644 --- a/drivers/iio/multiplexer/iio-mux.c +++ b/drivers/iio/multiplexer/iio-mux.c @@ -21,7 +21,7 @@ struct mux_ext_info_cache { char *data; - size_t size; + ssize_t size; }; struct mux_child { @@ -206,6 +206,9 @@ static ssize_t mux_write_ext_info(struct iio_dev *indio_dev, uintptr_t private, char *new; ssize_t ret; + if (len >= PAGE_SIZE) + return -EINVAL; + ret = iio_mux_select(mux, idx); if (ret < 0) return ret; -- 2.1.4
| |