From: Thomas Gleixner <tglx@inhell4.(none)>
Date: Fri, 13 Apr 2007 17:50:48 +0000 (+0200)
Subject: [MTD] Fix length comparison in MEMREADOOB
X-Git-Tag: v2.6.22-rc1~1116^2~32
X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=408b483d9cc2d839ecbc9134958c42814865081c;p=~emulex%2Finfiniband.git

[MTD] Fix length comparison in MEMREADOOB

The ops.len member is not initialized, because it is unused for this
operation. The length check needs to use ops.ooblen instead

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
---

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 1592eac64e5..8c86b802f21 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -553,7 +553,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
 		ops.datbuf = NULL;
 		ops.mode = MTD_OOB_PLACE;
 
-		if (ops.ooboffs && ops.len > (mtd->oobsize - ops.ooboffs))
+		if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
 			return -EINVAL;
 
 		ops.oobbuf = kmalloc(buf.length, GFP_KERNEL);