n_tty: check for negative and zero space return from tty_write_room
authorColin Ian King <colin.king@canonical.com>
Sat, 30 Mar 2019 00:46:28 +0000 (00:46 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 16 Apr 2019 13:21:33 +0000 (15:21 +0200)
commit9ef8927f45f2f8e365cda7cda81c079f29b8ad74
tree0a189703d0d9d0e686a6d30a1789792ffe80d1c4
parentf16aa97d3f575ea660f49d4698efe1c4a4c60919
n_tty: check for negative and zero space return from tty_write_room

The return from tty_write_room could potentially be negative if
a tty write_room driver returns an error number (not that any seem
to do). Rather than just check for a zero return, also check for
a -ve return. This avoids the unsigned nr being set to a large unsigned
value on the assignment from variable space and can lead to overflowing
the buffer buf.  Better to be safe than assume all write_room
implementations in tty drivers are going to do the right thing.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/n_tty.c