[CPUFREQ] fix show_trans_table

Fix show_trans_table when it overflows PAGE_SIZE.

* Not all snprintf calls were protected against being passed a negative
length.
* When show_trans_table overflows, len might be > PAGE_SIZE. In that case,
returns PAGE_SIZE.

Signed-off-by: Cesar Eduardo Barros <cesarb@cesarb.net>
Signed-off-by: Dave Jones <davej@codemonkey.org.uk>

diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 070421a5480e731116ed58845e5ac424cfaf0aba..ef09e069433b280c0dc58e0a51e6d0713a718a70 100644 (file)
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -114,7 +114,7 @@ show_trans_table(struct cpufreq_policy *policy, char *buf)
                                stat->freq_table[i]);
        }
        if (len >= PAGE_SIZE)
-               return len;
+               return PAGE_SIZE;
 
        len += snprintf(buf + len, PAGE_SIZE - len, "\n");
 
@@ -131,8 +131,12 @@ show_trans_table(struct cpufreq_policy *policy, char *buf)
                        len += snprintf(buf + len, PAGE_SIZE - len, "%9u ",
                                        stat->trans_table[i*stat->max_state+j]);
                }
+               if (len >= PAGE_SIZE)
+                       break;
                len += snprintf(buf + len, PAGE_SIZE - len, "\n");
        }
+       if (len >= PAGE_SIZE)
+               return PAGE_SIZE;
        return len;
 }
 CPUFREQ_STATDEVICE_ATTR(trans_table,0444,show_trans_table);