"Stable" kernel 2.6.25.7 released

> not quite. on 64 bit archs
>
>  count = (size_t)(2^32-1)
>
> would pass the
>
>  (ssize_t) count < 0
>
> check whereas
>
>  int in_size = size
>
> would still make it -1 and trigger the bug.

This is the code:

---
#define MAX_RW_COUNT (INT_MAX & PAGE_CACHE_MASK)

int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count
)
{
        struct inode *inode;
        loff_t pos;

        inode = file->f_path.dentry->d_inode;
        if (unlikely((ssize_t) count < 0))
                goto Einval;
        pos = *ppos;
        if (unlikely((pos < 0) || (loff_t) (pos + count) < 0))
                goto Einval;

        if (unlikely(inode->i_flock && mandatory_lock(inode))) {
                int retval = locks_mandatory_area(
                        read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WR
ITE,
                        inode, file, pos, count);
                if (retval < 0)
                        return retval;
        }
        return count > MAX_RW_COUNT ? MAX_RW_COUNT : count;

Einval:
        return -EINVAL;
}
---

This function pegs the value returned to MAX_RW_COUNT, which is at most 0x7FFFFFFF (it will
actually be reduced to a page boundary). If count = 0xFFFFFFFF, then 0xFFFFFFFF > 0x7FFFFFFF,
so 0x7FFFFFFF is the largest value that can be returned from this function. This is the value
that gets passed to tpm_write() as a size_t data type (see vfs_write()).