Revert "Check integer overflow in do_cmd_ioctl() and do_cmdtest_ioctl()."

This reverts commit 824ffcaf3a1bd55a111ed67cf5b0cb3cd18b405f.

The check is unnecessary because user_cmd.chanlist_len has already been
checked against the maximum supported by the subdevice.

Thanks to Dan Carpenter for pointing this out.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>

diff --git a/comedi/comedi_fops.c b/comedi/comedi_fops.c
index 1adc1db42c205f2208dfe5d55b3d272991eb3c6d..f8d396e1ff69b1ba7fe578d50c72eff974ea6f9e 100644 (file)
--- a/comedi/comedi_fops.c
+++ b/comedi/comedi_fops.c
@@ -1126,12 +1126,8 @@ static int do_cmd_ioctl(comedi_device * dev, void *arg, void *file)
        async->cmd = user_cmd;
        async->cmd.data = NULL;
        /* load channel/gain list */
-       if (async->cmd.chanlist_len <= ULONG_MAX / sizeof(int))
-               async->cmd.chanlist =
-                       kmalloc(async->cmd.chanlist_len * sizeof(int),
-                                       GFP_KERNEL);
-       else
-               async->cmd.chanlist = NULL;
+       async->cmd.chanlist =
+               kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL);
        if (!async->cmd.chanlist) {
                DPRINTK("allocation failed\n");
                ret = -ENOMEM;
@@ -1260,10 +1256,9 @@ static int do_cmdtest_ioctl(comedi_device * dev, void *arg, void *file)
 
        /* load channel/gain list */
        if (user_cmd.chanlist) {
-               if (user_cmd.chanlist_len <= ULONG_MAX / sizeof(int))
-                       chanlist =
-                               kmalloc(user_cmd.chanlist_len * sizeof(int),
-                               GFP_KERNEL);
+               chanlist =
+                       kmalloc(user_cmd.chanlist_len * sizeof(int),
+                       GFP_KERNEL);
                if (!chanlist) {
                        DPRINTK("allocation failed\n");
                        ret = -ENOMEM;