[MTD] Fix length comparison in MEMREADOOB

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=408b483d9cc2d839ecbc9134958c42814865081c
Commit:     408b483d9cc2d839ecbc9134958c42814865081c
Parent:     1cf9827b6852d5d81130efbf2e777e50b7126d23
Author:     Thomas Gleixner <tglx at inhell4.(none)>
AuthorDate: Fri Apr 13 19:50:48 2007 +0200
Committer:  David Woodhouse <dwmw2 at infradead.org>
CommitDate: Tue Apr 17 13:40:00 2007 -0400

    [MTD] Fix length comparison in MEMREADOOB
    
    The ops.len member is not initialized, because it is unused for this
    operation. The length check needs to use ops.ooblen instead
    
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Signed-off-by: David Woodhouse <dwmw2 at infradead.org>
---
 drivers/mtd/mtdchar.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 1592eac..8c86b80 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -553,7 +553,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
 		ops.datbuf = NULL;
 		ops.mode = MTD_OOB_PLACE;
 
-		if (ops.ooboffs && ops.len > (mtd->oobsize - ops.ooboffs))
+		if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
 			return -EINVAL;
 
 		ops.oobbuf = kmalloc(buf.length, GFP_KERNEL);