Comparing a size_t with less than zero is always false as size_t is unsigned. So, change the type of the variable to ssize_t and replicate the size check from mux_configure_channel() into mux_write_ext_info() thus ensuring that the size will fit in the ssize_t variable.
Detected by CoverityScan, CID#1415278 ("Unsigned compared against 0") Fixes: 1da8e16d2812 ("iio: multiplexer: new iio category and iio-mux driver") Reported-by: Colin Ian King <colin.k...@canonical.com> Acked-by: Jonathan Cameron <ji...@kernel.org> Signed-off-by: Peter Rosin <p...@axentia.se> --- drivers/iio/multiplexer/iio-mux.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c index 94d40f9bef4c..bab9e6902090 100644 --- a/drivers/iio/multiplexer/iio-mux.c +++ b/drivers/iio/multiplexer/iio-mux.c @@ -21,7 +21,7 @@ struct mux_ext_info_cache { char *data; - size_t size; + ssize_t size; }; struct mux_child { @@ -206,6 +206,9 @@ static ssize_t mux_write_ext_info(struct iio_dev *indio_dev, uintptr_t private, char *new; ssize_t ret; + if (len >= PAGE_SIZE) + return -EINVAL; + ret = iio_mux_select(mux, idx); if (ret < 0) return ret; -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html