From: Ian Abbott <abbotti@mev.co.uk>
Date: Fri, 13 Jan 2012 10:29:58 +0000 (+0000)
Subject: Revert "Check integer overflow in do_cmd_ioctl() and do_cmdtest_ioctl()."
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=b805037624b1789d296d9921c22e94c22af425c9;p=comedi.git

Revert "Check integer overflow in do_cmd_ioctl() and do_cmdtest_ioctl()."

This reverts commit 824ffcaf3a1bd55a111ed67cf5b0cb3cd18b405f.

The check is unnecessary because user_cmd.chanlist_len has already been
checked against the maximum supported by the subdevice.

Thanks to Dan Carpenter for pointing this out.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---

diff --git a/comedi/comedi_fops.c b/comedi/comedi_fops.c
index 1adc1db4..f8d396e1 100644
--- a/comedi/comedi_fops.c
+++ b/comedi/comedi_fops.c
@@ -1126,12 +1126,8 @@ static int do_cmd_ioctl(comedi_device * dev, void *arg, void *file)
 	async->cmd = user_cmd;
 	async->cmd.data = NULL;
 	/* load channel/gain list */
-	if (async->cmd.chanlist_len <= ULONG_MAX / sizeof(int))
-		async->cmd.chanlist =
-			kmalloc(async->cmd.chanlist_len * sizeof(int),
-					GFP_KERNEL);
-	else
-		async->cmd.chanlist = NULL;
+	async->cmd.chanlist =
+		kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL);
 	if (!async->cmd.chanlist) {
 		DPRINTK("allocation failed\n");
 		ret = -ENOMEM;
@@ -1260,10 +1256,9 @@ static int do_cmdtest_ioctl(comedi_device * dev, void *arg, void *file)
 
 	/* load channel/gain list */
 	if (user_cmd.chanlist) {
-		if (user_cmd.chanlist_len <= ULONG_MAX / sizeof(int))
-			chanlist =
-				kmalloc(user_cmd.chanlist_len * sizeof(int),
-				GFP_KERNEL);
+		chanlist =
+			kmalloc(user_cmd.chanlist_len * sizeof(int),
+			GFP_KERNEL);
 		if (!chanlist) {
 			DPRINTK("allocation failed\n");
 			ret = -ENOMEM;