[S390] cio: fix wrong buffer access in cio_ignore_write
authorSebastian Ott <sebott@linux.vnet.ibm.com>
Thu, 26 Mar 2009 14:24:16 +0000 (15:24 +0100)
committerMartin Schwidefsky <schwidefsky@de.ibm.com>
Thu, 26 Mar 2009 14:24:16 +0000 (15:24 +0100)
Writing only spaces to /proc/cio_ignore will cause a buffer overflow
since the size_t value i will not become negative and so buf[-1UL] is
accessed. Change the value of i to ssize_t.

Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
drivers/s390/cio/blacklist.c

index fe00be3..6565f02 100644 (file)
@@ -336,8 +336,7 @@ cio_ignore_write(struct file *file, const char __user *user_buf,
                 size_t user_len, loff_t *offset)
 {
        char *buf;
-       size_t i;
-       ssize_t rc, ret;
+       ssize_t rc, ret, i;
 
        if (*offset)
                return -EINVAL;