Commit 408b483d authored Apr 13, 2007 by Thomas Gleixner Committed by David Woodhouse Apr 17, 2007

[MTD] Fix length comparison in MEMREADOOB



The ops.len member is not initialized, because it is unused for this
operation. The length check needs to use ops.ooblen instead

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

parent 1cf9827b

drivers/mtd/mtdchar.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -553,7 +553,7 @@ static int mtd_ioctl(struct inode inode, struct file file,
		ops.datbuf = NULL;
		ops.mode = MTD_OOB_PLACE;

		if (ops.ooboffs && ops.len > (mtd->oobsize - ops.ooboffs))
		if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
		return -EINVAL;

		ops.oobbuf = kmalloc(buf.length, GFP_KERNEL);