diff options
| author | David Fries <David@Fries.net> | 2014-11-11 03:19:37 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-11-27 04:09:01 +0100 |
| commit | 4b97b27939dd9b9ddbd4058efc96d45bc7163601 (patch) | |
| tree | 18a83e875711fb4ee38a413197d0766f241df178 /drivers | |
| parent | cn: verify msg->len before making callback (diff) | |
| download | linux-4b97b27939dd9b9ddbd4058efc96d45bc7163601.tar.xz linux-4b97b27939dd9b9ddbd4058efc96d45bc7163601.zip | |
w1: avoid potential u16 overflow
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: David Fries <David@Fries.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/w1/w1_netlink.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c index dd9656237274..881597a191b8 100644 --- a/drivers/w1/w1_netlink.c +++ b/drivers/w1/w1_netlink.c @@ -598,7 +598,7 @@ static void w1_cn_callback(struct cn_msg *cn, struct netlink_skb_parms *nsp) msg = (struct w1_netlink_msg *)(cn + 1); if (node_count) { int size; - u16 reply_size = sizeof(*cn) + cn->len + slave_len; + int reply_size = sizeof(*cn) + cn->len + slave_len; if (cn->flags & W1_CN_BUNDLE) { /* bundling duplicats some of the messages */ reply_size += 2 * cmd_count * (sizeof(struct cn_msg) + |