USB: cxacru: fix an bounds check warning

This is a privileged operation so it doesn't matter much.  We use "tmp"
as an offset into an array.  If it were invalid we could read out of
bounds and trigger an oops if the memory is not mapped.  Plus it makes
static checkers complain.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 1173f9cbc137ef1b175a84de7d2c8c81219323f5..0a866e90b49c80ee04061ae1af3ac5020dd3a237 100644 (file)
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -476,6 +476,8 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
                        return -EINVAL;
                if (index < 0 || index > 0x7f)
                        return -EINVAL;
+               if (tmp < 0 || tmp > len - pos)
+                       return -EINVAL;
                pos += tmp;
 
                /* skip trailing newline */