[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 06/29] device/chario.c (char_write): check if io_count is larger
From: |
Marin Ramesa |
Subject: |
[PATCH 06/29] device/chario.c (char_write): check if io_count is larger or equal to zero and cast it to vm_size_t |
Date: |
Mon, 9 Dec 2013 23:57:21 +0100 |
Check if member io_count is non-negative. If it is negative, the call to
vm_deallocate() will fail. Return KERN_INVALID_ARGUMENT in that case.
* device/chario.c (char_write): Check if member io_count is non-negative.
(char_write) (vm_deallocate) (io_count): Cast to vm_size_t.
---
device/chario.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/device/chario.c b/device/chario.c
index 8d68857..c9f946c 100644
--- a/device/chario.c
+++ b/device/chario.c
@@ -325,8 +325,12 @@ out:
simple_unlock(&tp->t_lock);
splx(s);
- if (!(ior->io_op & IO_INBAND))
- (void) vm_deallocate(device_io_map, addr, ior->io_count);
+ if (!(ior->io_op & IO_INBAND)) {
+ if (ior->io_count >= 0)
+ (void) vm_deallocate(device_io_map, addr,
(vm_size_t)ior->io_count);
+ else
+ return KERN_INVALID_ARGUMENT;
+ }
return rc;
}
--
1.8.1.4
- [PATCH 01/29] i386: move prototypes to fix implicit declaration of function, Marin Ramesa, 2013/12/09
- [PATCH 03/29] i386/i386/db_interface.c: use vm_offset_t instead of an unsigned int, Marin Ramesa, 2013/12/09
- [PATCH 06/29] device/chario.c (char_write): check if io_count is larger or equal to zero and cast it to vm_size_t,
Marin Ramesa <=
- [PATCH 07/29] device/chario.c (char_read): check if io_count is larger or equal to zero, Marin Ramesa, 2013/12/09
- [PATCH 08/29] device/chario.c: trivial stylistic fix for consistency, Marin Ramesa, 2013/12/09
- [PATCH 09/29] device/cirbuf.c (getc): use char instead of an unsigned char, Marin Ramesa, 2013/12/09
- [PATCH 10/29] device/cirbuf.c (cb_alloc): use vm_size_t instead of an int, Marin Ramesa, 2013/12/09
- [PATCH 11/29] device/cirbuf.c (cb_free): use vm_size_t instead of an int, Marin Ramesa, 2013/12/09
- [PATCH 12/29] device/cons.c: fix argument list, Marin Ramesa, 2013/12/09
- [PATCH 13/29] device/dev_pager.c (device_pager_data_request): remove forward declaration, Marin Ramesa, 2013/12/09
- [PATCH 14/29] device/dev_pager.c (device_pager_data_request): cast to (void *) instead to (char *), Marin Ramesa, 2013/12/09
- [PATCH 15/29] device/dev_pager.c (device_pager_data_request_done): check if io_count is larger or equal to zero and cast it to vm_size_t, Marin Ramesa, 2013/12/09