[PATCH] staging: vme_user: handle zero image size in read/write

[LiuJunyuan]

vme_get_size() can return zero for an unallocated image. The existing
image_size - 1 checks underflow in that case and can allow an invalid
position to proceed, wrapping the subsequent count calculation. Check
image_size and *ppos directly instead.

Signed-off-by: LiuJunyuan <2058432396@xxxxxx>
---
 drivers/staging/vme_user/vme_user.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vme_user/vme_user.c b/drivers/staging/vme_user/vme_user.c
index a472a38ef613..58566c01003a 100644
--- a/drivers/staging/vme_user/vme_user.c
+++ b/drivers/staging/vme_user/vme_user.c
@@ -213,7 +213,7 @@ static ssize_t vme_user_read(struct file *file, char __user *buf, size_t count,
 	image_size = vme_get_size(image[minor].resource);
 
 	/* Ensure we are starting at a valid location */
-	if ((*ppos < 0) || (*ppos > (image_size - 1))) {
+	if (*ppos < 0 || image_size == 0 || *ppos >= image_size) {
 		mutex_unlock(&image[minor].mutex);
 		return 0;
 	}
@@ -255,7 +255,7 @@ static ssize_t vme_user_write(struct file *file, const char __user *buf,
 	image_size = vme_get_size(image[minor].resource);
 
 	/* Ensure we are starting at a valid location */
-	if ((*ppos < 0) || (*ppos > (image_size - 1))) {
+	if (*ppos < 0 || image_size == 0 || *ppos >= image_size) {
 		mutex_unlock(&image[minor].mutex);
 		return 0;
 	}
-- 
2.43.0