diff options
| author | Ralf Baechle <ralf@linux-mips.org> | 2000-06-19 22:45:37 +0000 |
|---|---|---|
| committer | Ralf Baechle <ralf@linux-mips.org> | 2000-06-19 22:45:37 +0000 |
| commit | 6d403070f28cd44860fdb3a53be5da0275c65cf4 (patch) | |
| tree | 0d0e7fe7b5fb7568d19e11d7d862b77a866ce081 /fs/read_write.c | |
| parent | ecf1bf5f6c2e668d03b0a9fb026db7aa41e292e1 (diff) | |
Merge with 2.4.0-test1-ac21 + pile of MIPS cleanups to make merging
possible. Chainsawed RM200 kernel to compile again. Jazz machine
status unknown.
Diffstat (limited to 'fs/read_write.c')
| -rw-r--r-- | fs/read_write.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/fs/read_write.c b/fs/read_write.c index 4569ee18a..3d3519146 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -199,9 +199,19 @@ static ssize_t do_readv_writev(int type, struct file *file, if (copy_from_user(iov, vector, count*sizeof(*vector))) goto out; + /* BSD readv/writev returns EINVAL if one of the iov_len + values < 0 or tot_len overflowed a 32-bit integer. -ink */ tot_len = 0; - for (i = 0 ; i < count ; i++) - tot_len += iov[i].iov_len; + ret = -EINVAL; + for (i = 0 ; i < count ; i++) { + size_t tmp = tot_len; + int len = iov[i].iov_len; + if (len < 0) + goto out; + (u32)tot_len += len; + if (tot_len < tmp || tot_len < (u32)len) + goto out; + } inode = file->f_dentry->d_inode; /* VERIFY_WRITE actually means a read, as we write to user space */ |