[PATCH] firmware/dcdbas: add size check in smi_data_write

Add a size check in smi_data_write to prevent possible wrapping problems
with large pos values when calling smi_data_buf_realloc on 32-bit.

Signed-off-by: Doug Warzecha <Douglas_Warzecha@dell.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index 8bcb58cd4ac0f93daf7b4bdc3924e2ef4caa2e2a..1865b56fb141643878b50b4874c4be56f612ff0c 100644 (file)
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -8,7 +8,7 @@
  *
  *  See Documentation/dcdbas.txt for more information.
  *
- *  Copyright (C) 1995-2005 Dell Inc.
+ *  Copyright (C) 1995-2006 Dell Inc.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License v2.0 as published by
@@ -40,7 +40,7 @@
 #include "dcdbas.h"
 
 #define DRIVER_NAME            "dcdbas"
-#define DRIVER_VERSION         "5.6.0-2"
+#define DRIVER_VERSION         "5.6.0-3.2"
 #define DRIVER_DESCRIPTION     "Dell Systems Management Base Driver"
 
 static struct platform_device *dcdbas_pdev;
@@ -175,6 +175,9 @@ static ssize_t smi_data_write(struct kobject *kobj, char *buf, loff_t pos,
 {
        ssize_t ret;
 
+       if ((pos + count) > MAX_SMI_DATA_BUF_SIZE)
+               return -EINVAL;
+
        mutex_lock(&smi_data_lock);
 
        ret = smi_data_buf_realloc(pos + count);