Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3d8fa456 authored by Peter Hurley's avatar Peter Hurley Committed by Linus Torvalds
Browse files

ipc: clamp with min() 



Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
Acked-by: default avatarStanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 08d76760

ipc/msgutil.c

+8 −22
Original line number Diff line number Diff line
@@ -41,8 +41,8 @@ struct msg_msgseg { 
	/* the next part of the message follows immediately */

};



#define DATALEN_MSG	(PAGE_SIZE-sizeof(struct msg_msg))

#define DATALEN_SEG	(PAGE_SIZE-sizeof(struct msg_msgseg))

#define DATALEN_MSG	(int)(PAGE_SIZE-sizeof(struct msg_msg))

#define DATALEN_SEG	(int)(PAGE_SIZE-sizeof(struct msg_msgseg))



struct msg_msg *load_msg(const void __user *src, int len)

{
@@ -51,10 +51,7 @@ struct msg_msg *load_msg(const void __user *src, int len) 
	int err;

	int alen;



	alen = len;

	if (alen > DATALEN_MSG)

		alen = DATALEN_MSG;



	alen = min(len, DATALEN_MSG);

	msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL);

	if (msg == NULL)

		return ERR_PTR(-ENOMEM);
@@ -72,9 +69,7 @@ struct msg_msg *load_msg(const void __user *src, int len) 
	pseg = &msg->next;

	while (len > 0) {

		struct msg_msgseg *seg;

		alen = len;

		if (alen > DATALEN_SEG)

			alen = DATALEN_SEG;

		alen = min(len, DATALEN_SEG);

		seg = kmalloc(sizeof(*seg) + alen,

						 GFP_KERNEL);

		if (seg == NULL) {
@@ -113,19 +108,14 @@ struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst) 
	if (src->m_ts > dst->m_ts)

		return ERR_PTR(-EINVAL);



	alen = len;

	if (alen > DATALEN_MSG)

		alen = DATALEN_MSG;



	alen = min(len, DATALEN_MSG);

	memcpy(dst + 1, src + 1, alen);



	len -= alen;

	dst_pseg = dst->next;

	src_pseg = src->next;

	while (len > 0) {

		alen = len;

		if (alen > DATALEN_SEG)

			alen = DATALEN_SEG;

		alen = min(len, DATALEN_SEG);

		memcpy(dst_pseg + 1, src_pseg + 1, alen);

		dst_pseg = dst_pseg->next;

		len -= alen;
@@ -148,9 +138,7 @@ int store_msg(void __user *dest, struct msg_msg *msg, int len) 
	int alen;

	struct msg_msgseg *seg;



	alen = len;

	if (alen > DATALEN_MSG)

		alen = DATALEN_MSG;

	alen = min(len, DATALEN_MSG);

	if (copy_to_user(dest, msg + 1, alen))

		return -1;
@@ -158,9 +146,7 @@ int store_msg(void __user *dest, struct msg_msg *msg, int len) 
	dest = ((char __user *)dest) + alen;

	seg = msg->next;

	while (len > 0) {

		alen = len;

		if (alen > DATALEN_SEG)

			alen = DATALEN_SEG;

		alen = min(len, DATALEN_SEG);

		if (copy_to_user(dest, seg + 1, alen))

			return -1;

		len -= alen;