summary refs log tree commit diff
path: root/arch/s390/mm/cmm.c
diff options
context:
space:
mode:
authorHeiko Carstens <heiko.carstens@de.ibm.com>2013-10-14 13:58:10 +0200
committerMartin Schwidefsky <schwidefsky@de.ibm.com>2013-10-24 17:17:07 +0200
commit041058a16a71a1257a1c3c19a55d74641912b918 (patch)
treea0754183b0adea5d2eb335438270ff45fd6e1e49 /arch/s390/mm/cmm.c
parent160d378ebc76a796cc16ae873baeed02992f9202 (diff)
downloadlinux-041058a16a71a1257a1c3c19a55d74641912b918.tar.gz
s390/cmm: make copy_from_user() invocation provably correct
Get rid of these two warnings:

In function 'copy_from_user',
    inlined from 'cmm_timeout_handler' at arch/s390/mm/cmm.c:310:
      uaccess.h:303: warning: call to 'copy_from_user_overflow' declared
      with attribute warning: copy_from_user() buffer size is not provably
      correct
In function 'copy_from_user',
    inlined from 'cmm_pages_handler' at arch/s390/mm/cmm.c:270:
      uaccess.h:303: warning: call to 'copy_from_user_overflow' declared
      with attribute warning: copy_from_user() buffer size is not provably
      correct

Change the "len" type to unsigned int, so we can make sure that there is no
buffer overflow. This also generates less code.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Diffstat (limited to 'arch/s390/mm/cmm.c')
-rw-r--r--arch/s390/mm/cmm.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c
index 9d84a1feefef..76741306af2a 100644
--- a/arch/s390/mm/cmm.c
+++ b/arch/s390/mm/cmm.c
@@ -257,8 +257,8 @@ static int cmm_pages_handler(ctl_table *ctl, int write, void __user *buffer,
 			     size_t *lenp, loff_t *ppos)
 {
 	char buf[16], *p;
+	unsigned int len;
 	long nr;
-	int len;
 
 	if (!*lenp || (*ppos && !write)) {
 		*lenp = 0;
@@ -298,7 +298,7 @@ static int cmm_timeout_handler(ctl_table *ctl, int write,  void __user *buffer,
 {
 	char buf[64], *p;
 	long nr, seconds;
-	int len;
+	unsigned int len;
 
 	if (!*lenp || (*ppos && !write)) {
 		*lenp = 0;