read/write: error oversized requests
authorAlan Cox <alan@linux.intel.com>
Sat, 24 Sep 2016 13:17:25 +0000 (14:17 +0100)
committerAlan Cox <alan@linux.intel.com>
Sat, 24 Sep 2016 13:17:25 +0000 (14:17 +0100)
We could allow it but it's undefined behaviour in the standard and in some
of our driver code, so force a nice clear error.

Kernel/syscall_fs.c

index db58a8c..b4e0721 100644 (file)
@@ -403,7 +403,12 @@ arg_t _read(void)
        uint8_t flag;
 
        if (!nbytes)
-               return 0;
+               return 0;
+
+       if ((ssize_t)nbytes < 0) {
+               udata.u_error = EINVAL;
+               return -1;
+       }
 
        if (!valaddr(buf, nbytes))
                return -1;
@@ -466,7 +471,12 @@ arg_t _write(void)
        uint8_t flag;
 
        if (!nbytes)
-               return 0;
+               return 0;
+
+       if ((ssize_t)nbytes < 0) {
+               udata.u_error = EINVAL;
+               return -1;
+       }
 
        if (!valaddr(buf, nbytes))
                return -1;