2022-09-15 06:01:59

by Jiapeng Chong

Subject: [PATCH] io_uring: rw: Fix an unsigned comparison which can never be negative

The parameter 'res' is defined as unsigned type, so the following if
statement is invalid, we can modify the type of res to long.
if (res < 0)
res = io->bytes_done;
else
res += io->bytes_done;

io_uring/rw.c:265 io_fixup_rw_res() warn: unsigned 'res' is never less than zero.

Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2184
Reported-by: Abaci Robot <[email protected]>
Signed-off-by: Jiapeng Chong <[email protected]>
---
io_uring/rw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/io_uring/rw.c b/io_uring/rw.c
index b777c35378b9..08d88481153c 100644
--- a/io_uring/rw.c
+++ b/io_uring/rw.c
@@ -256,7 +256,7 @@ static bool __io_complete_rw_common(struct io_kiocb *req, long res)
return false;
}

-static inline unsigned io_fixup_rw_res(struct io_kiocb *req, unsigned res)
+static inline unsigned io_fixup_rw_res(struct io_kiocb *req, long res)
{
struct io_async_rw *io = req->async_data;

--
2.20.1.7.g153144c

2022-09-15 06:33:29

by Jens Axboe

Subject: Re: [PATCH] io_uring: rw: Fix an unsigned comparison which can never be negative

On 9/14/22 11:49 PM, Jiapeng Chong wrote:
> The parameter 'res' is defined as unsigned type, so the following if
> statement is invalid, we can modify the type of res to long.
> if (res < 0)
> res = io->bytes_done;
> else
> res += io->bytes_done;
>
> io_uring/rw.c:265 io_fixup_rw_res() warn: unsigned 'res' is never less than zero.

This one is already fixed here:

https://git.kernel.dk/cgit/linux-block/commit/?h=io_uring-6.0&id=62bb0647b14646fa6c9aa25ecdf67ad18f13523c

--
Jens Axboe