From: Al Viro <viro@ftp.linux.org.uk>
Date: Sat, 29 Oct 2005 10:56:13 +0000 (+0100)
Subject: [PATCH] idmouse cleanup and overflow fix
X-Git-Tag: v2.6.15-rc1~731^2~6
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=018a2cdf1e633497bb4f01eb86a7cbffa611776d;p=linux-2.6

[PATCH] idmouse cleanup and overflow fix

switched to simple_read_from_buffer(), killed broken use of min().
Incidentally, that use of min() had been fixed once, only to be
reintroduced in commit 4244f72436ab77c3c29a6447af81734ab3925d85:

    [PATCH] USB: upgrade of the idmouse driver

[snip]
-       if (count > IMGSIZE - *ppos)
-               count = IMGSIZE - *ppos;
+       count = min ((loff_t)count, IMGSIZE - (*ppos));

Note the lovely use of cast to shut the warning about misuse of min()
up...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---

diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
index 3944a55ed7..1dc3e0f730 100644
--- a/drivers/usb/misc/idmouse.c
+++ b/drivers/usb/misc/idmouse.c
@@ -319,20 +319,8 @@ static ssize_t idmouse_read(struct file *file, char __user *buffer, size_t count
 		return -ENODEV;
 	}
 
-	if (*ppos >= IMGSIZE) {
-		up (&dev->sem);
-		return 0;
-	}
-
-	count = min ((loff_t)count, IMGSIZE - (*ppos));
-
-	if (copy_to_user (buffer, dev->bulk_in_buffer + *ppos, count)) {
-		result = -EFAULT;
-	} else {
-		result = count;
-		*ppos += count;
-	}
-
+	result = simple_read_from_buffer(buffer, count, ppos,
+					dev->bulk_in_buffer, IMGSIZE);
 	/* unlock the device */
 	up(&dev->sem);
 	return result;