summaryrefslogtreecommitdiff
path: root/drivers/usb/atm
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2016-01-30 17:34:55 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2016-02-04 00:52:10 +0300
commit46e3cafb01feb107a681e89fd9b4f1cd938a601f (patch)
tree50a6daf1028c3d3598e50798a3d329f8fe6b3fe5 /drivers/usb/atm
parent1b83349fddd1efa814a83735e44e684a139d2425 (diff)
downloadlinux-46e3cafb01feb107a681e89fd9b4f1cd938a601f.tar.xz
USB: cxacru: fix an bounds check warning
This is a privileged operation so it doesn't matter much. We use "tmp" as an offset into an array. If it were invalid we could read out of bounds and trigger an oops if the memory is not mapped. Plus it makes static checkers complain. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/atm')
-rw-r--r--drivers/usb/atm/cxacru.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 1173f9cbc137..0a866e90b49c 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -476,6 +476,8 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
return -EINVAL;
if (index < 0 || index > 0x7f)
return -EINVAL;
+ if (tmp < 0 || tmp > len - pos)
+ return -EINVAL;
pos += tmp;
/* skip trailing newline */