commit 900469d0b0c337db19908f77d172f4b17f4573ba
author José Adolfo Galdámez <josegalre@pac-rom.com> Sat Jun 20 23:45:36 2015 -0600
committer William Bellavance <flintman@flintmancomputers.com> Wed Feb 10 20:02:51 2016 -0500
tree e7c8e6e70ad09ecc74c7385269f9a7a908489b88
parent 3591a444f6b8cb82a9b88a49a4e67d8f4b61a6de

Merge tag 'v3.4.108' into mm-6.0

Change-Id: I5ee718e5c87c9647c6edf0926a887679e065a649
Signed-off-by: José Adolfo Galdámez <josegalre@pac-rom.com>

drivers/spi/spidev.c

diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index aaf0265..5c42974 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -267,7 +267,10 @@
 		k_tmp->len = u_tmp->len;
 
 		total += k_tmp->len;
-		if (total > bufsiz) {
+		/* Check total length of transfers.  Also check each
+		 * transfer length to avoid arithmetic overflow.
+		 */
+		if (total > bufsiz || k_tmp->len > bufsiz) {
 			status = -EMSGSIZE;
 			goto done;
 		}