evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

efivarfs: Fix return value of efivarfs_file_write()

Browse source 
We're stuffing a variable of type size_t (unsigned) into a ssize_t
(signed) which, even though both types should be the same number of
bits, it's just asking for sign issues to be introduced.

Cc: Jeremy Kerr <jeremy.kerr@canonical.com>
Reported-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
This commit is contained in:
Matt Fleming 2012-10-26 12:18:53 +01:00
parent aeeaa8d46a
commit cfcf2f1170
1 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/firmware/efivars.c
View file

@ -694,6 +694,7 @@ static ssize_t efivarfs_file_write(struct file *file,
struct inode *inode = file->f_mapping->host; struct inode *inode = file->f_mapping->host;
unsigned long datasize = count - sizeof(attributes); unsigned long datasize = count - sizeof(attributes);
unsigned long newdatasize; unsigned long newdatasize;
ssize_t bytes = 0;
if (count < sizeof(attributes)) if (count < sizeof(attributes))
return -EINVAL; return -EINVAL;
@ -706,22 +707,22 @@ static ssize_t efivarfs_file_write(struct file *file,
efivars = var->efivars; efivars = var->efivars;
if (copy_from_user(&attributes, userbuf, sizeof(attributes))) { if (copy_from_user(&attributes, userbuf, sizeof(attributes))) {
count = -EFAULT; bytes = -EFAULT;
goto out; goto out;
} }
if (attributes & ~(EFI_VARIABLE_MASK)) { if (attributes & ~(EFI_VARIABLE_MASK)) {
count = -EINVAL; bytes = -EINVAL;
goto out; goto out;
} }
if (copy_from_user(data, userbuf + sizeof(attributes), datasize)) { if (copy_from_user(data, userbuf + sizeof(attributes), datasize)) {
count = -EFAULT; bytes = -EFAULT;
goto out; goto out;
} }
if (validate_var(&var->var, data, datasize) == false) { if (validate_var(&var->var, data, datasize) == false) {
count = -EINVAL; bytes = -EINVAL;
goto out; goto out;
} }
@ -744,6 +745,8 @@ static ssize_t efivarfs_file_write(struct file *file,
return efi_status_to_err(status); return efi_status_to_err(status);
} }
bytes = count;
/* /*
* Writing to the variable may have caused a change in size (which * Writing to the variable may have caused a change in size (which
* could either be an append or an overwrite), or the variable to be * could either be an append or an overwrite), or the variable to be
@ -778,7 +781,7 @@ static ssize_t efivarfs_file_write(struct file *file,
out: out:
kfree(data); kfree(data);
return count; return bytes;
} }
static ssize_t efivarfs_file_read(struct file *file, char __user *userbuf, static ssize_t efivarfs_file_read(struct file *file, char __user *userbuf,