From b805037624b1789d296d9921c22e94c22af425c9 Mon Sep 17 00:00:00 2001 From: Ian Abbott Date: Fri, 13 Jan 2012 10:29:58 +0000 Subject: [PATCH] Revert "Check integer overflow in do_cmd_ioctl() and do_cmdtest_ioctl()." This reverts commit 824ffcaf3a1bd55a111ed67cf5b0cb3cd18b405f. The check is unnecessary because user_cmd.chanlist_len has already been checked against the maximum supported by the subdevice. Thanks to Dan Carpenter for pointing this out. Signed-off-by: Ian Abbott --- comedi/comedi_fops.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/comedi/comedi_fops.c b/comedi/comedi_fops.c index 1adc1db4..f8d396e1 100644 --- a/comedi/comedi_fops.c +++ b/comedi/comedi_fops.c @@ -1126,12 +1126,8 @@ static int do_cmd_ioctl(comedi_device * dev, void *arg, void *file) async->cmd = user_cmd; async->cmd.data = NULL; /* load channel/gain list */ - if (async->cmd.chanlist_len <= ULONG_MAX / sizeof(int)) - async->cmd.chanlist = - kmalloc(async->cmd.chanlist_len * sizeof(int), - GFP_KERNEL); - else - async->cmd.chanlist = NULL; + async->cmd.chanlist = + kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL); if (!async->cmd.chanlist) { DPRINTK("allocation failed\n"); ret = -ENOMEM; @@ -1260,10 +1256,9 @@ static int do_cmdtest_ioctl(comedi_device * dev, void *arg, void *file) /* load channel/gain list */ if (user_cmd.chanlist) { - if (user_cmd.chanlist_len <= ULONG_MAX / sizeof(int)) - chanlist = - kmalloc(user_cmd.chanlist_len * sizeof(int), - GFP_KERNEL); + chanlist = + kmalloc(user_cmd.chanlist_len * sizeof(int), + GFP_KERNEL); if (!chanlist) { DPRINTK("allocation failed\n"); ret = -ENOMEM; -- 2.26.2