Module Name: src Committed By: riastradh Date: Sat Mar 12 17:07:10 UTC 2022
Modified Files: src/sys/dev/pad: pad.c Log Message: pad(4): Do harmless, not harmful, integer truncation. Reported-by: syzbot+917ff3551897f1a99...@syzkaller.appspotmail.com To generate a diff of this commit: cvs rdiff -u -r1.75 -r1.76 src/sys/dev/pad/pad.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/dev/pad/pad.c diff -u src/sys/dev/pad/pad.c:1.75 src/sys/dev/pad/pad.c:1.76 --- src/sys/dev/pad/pad.c:1.75 Mon Jun 14 18:44:53 2021 +++ src/sys/dev/pad/pad.c Sat Mar 12 17:07:10 2022 @@ -1,4 +1,4 @@ -/* $NetBSD: pad.c,v 1.75 2021/06/14 18:44:53 riastradh Exp $ */ +/* $NetBSD: pad.c,v 1.76 2022/03/12 17:07:10 riastradh Exp $ */ /*- * Copyright (c) 2007 Jared D. McNeill <jmcne...@invisible.ca> @@ -27,7 +27,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: pad.c,v 1.75 2021/06/14 18:44:53 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: pad.c,v 1.76 2022/03/12 17:07:10 riastradh Exp $"); #include <sys/param.h> #include <sys/types.h> @@ -506,7 +506,7 @@ pad_read(struct pad_softc *sc, off_t *of DPRINTF("%s: resid=%zu\n", __func__, uio->uio_resid); while (uio->uio_resid > 0) { mutex_enter(&sc->sc_intr_lock); - err = pad_get_block(sc, &pb, uio->uio_resid); + err = pad_get_block(sc, &pb, MIN(uio->uio_resid, INT_MAX)); mutex_exit(&sc->sc_intr_lock); if (err) break;