summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBen Chan <benchan@chromium.org>2014-06-28 06:17:24 (GMT)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-06-29 21:41:04 (GMT)
commit0fbce84c6f0c5ba7ce2be5fec19caaca62586883 (patch)
tree6df066d729121124a7ef86f0a5c429c4b88d9959
parent78adbb284cf319edd05d7322ca41e877b6f628e5 (diff)
downloadlinux-0fbce84c6f0c5ba7ce2be5fec19caaca62586883.tar.xz
staging: gdm72xx: return -EINVAL instead of BUG_ON for invalid data length
This patch changes gdm_usb_send() and gdm_sdio_send() to return -EINVAL instead of calling BUG_ON if an invalid data length is passed to the functions. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Reported-by: Michalis Pappas <mpappas@fastmail.fm> Signed-off-by: Ben Chan <benchan@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/staging/gdm72xx/gdm_sdio.c3
-rw-r--r--drivers/staging/gdm72xx/gdm_usb.c3
2 files changed, 4 insertions, 2 deletions
diff --git a/drivers/staging/gdm72xx/gdm_sdio.c b/drivers/staging/gdm72xx/gdm_sdio.c
index 0c6a3eb..9d2de6f 100644
--- a/drivers/staging/gdm72xx/gdm_sdio.c
+++ b/drivers/staging/gdm72xx/gdm_sdio.c
@@ -390,7 +390,8 @@ static int gdm_sdio_send(void *priv_dev, void *data, int len,
u16 cmd_evt;
unsigned long flags;
- BUG_ON(len > TX_BUF_SIZE - TYPE_A_HEADER_SIZE);
+ if (len > TX_BUF_SIZE - TYPE_A_HEADER_SIZE)
+ return -EINVAL;
spin_lock_irqsave(&tx->lock, flags);
diff --git a/drivers/staging/gdm72xx/gdm_usb.c b/drivers/staging/gdm72xx/gdm_usb.c
index cd8e6e4..971976c 100644
--- a/drivers/staging/gdm72xx/gdm_usb.c
+++ b/drivers/staging/gdm72xx/gdm_usb.c
@@ -312,7 +312,8 @@ static int gdm_usb_send(void *priv_dev, void *data, int len,
return -ENODEV;
}
- BUG_ON(len > TX_BUF_SIZE - padding - 1);
+ if (len > TX_BUF_SIZE - padding - 1)
+ return -EINVAL;
spin_lock_irqsave(&tx->lock, flags);