isapnp_proc_bus_read() truncates the position to an int. A pread() at
an offset like 0xfffffc00 turns it negative, the check against the size
of the configuration space passes, and the loop then puts everything
from that position up to byte 256 into the reader's buffer, no matter
how few bytes were asked for.
Keep the position as a loff_t and clamp the count against what is left
of the configuration space.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: <redacted>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
drivers/pnp/isapnp/proc.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/pnp/isapnp/proc.c b/drivers/pnp/isapnp/proc.c
index c1f6e6bd0eb2..8197c7f29743 100644
--- a/drivers/pnp/isapnp/proc.c
+++ b/drivers/pnp/isapnp/proc.c
@@ -23,14 +23,12 @@ static ssize_t isapnp_proc_bus_read(struct file *file, char __user * buf,
size_t nbytes, loff_t * ppos)
{
struct pnp_dev *dev = pde_data(file_inode(file));
- int pos = *ppos;
+ loff_t pos = *ppos;
int cnt, size = 256;
if (pos >= size)
return 0;
- if (nbytes >= size)
- nbytes = size;
- if (pos + nbytes > size)
+ if (nbytes > size - pos)
nbytes = size - pos;
cnt = nbytes;
--
2.53.0