From a1e44d6ac5577b78ec85833b22d58345b2758ebb Mon Sep 17 00:00:00 2001 From: Lars-Peter Clausen Date: Thu, 8 Dec 2011 18:35:51 +0100 Subject: [PATCH] staging:iio: Fix sw_ring memory corruption The sw_ring does not properly handle the case where the write pointer already has wrapped around, the read pointer has not and the remaining buffer space at the end is enough to fill the read buffer: +-----------------------------------+ | | |##data##| | +-----------------------------------+ write_p read_p In this case the current code will copy all available data to the buffer and as a result will write beyond the bounds of the buffer and cause a memory corruption. To address this issue this patch adds code to calculate the available buffer space and makes sure that the number of bytes to copy does not exceed this number. This allows the code which copies the data around to be simplified as it only has to consider two cases: Read wraps around and read does not wrap around. Signed-off-by: Lars-Peter Clausen Acked-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --- Reading git-format-patch failed