2007-10-26 17:31:36

by Chuck Lever III

[permalink] [raw]
Subject: [PATCH 08/27] SUNRPC: Prevent length underflow in read_flush()

Make sure we compare an unsigned length to an unsigned count in
read_flush().

Signed-off-by: Chuck Lever <[email protected]>
---

net/sunrpc/cache.c | 10 +++++-----
1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 8e05557..578084f 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,
struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
char tbuf[20];
unsigned long p = *ppos;
- int len;
+ size_t len;

sprintf(tbuf, "%lu\n", cd->flush_time);
len = strlen(tbuf);
if (p >= len)
return 0;
len -= p;
- if (len > count) len = count;
+ if (len > count)
+ len = count;
if (copy_to_user(buf, (void*)(tbuf+p), len))
- len = -EFAULT;
- else
- *ppos += len;
+ return -EFAULT;
+ *ppos += len;
return len;
}



-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs


2007-10-26 18:25:01

by Trond Myklebust

[permalink] [raw]
Subject: Re: [PATCH 08/27] SUNRPC: Prevent length underflow in read_flush()

This one needs to go through Bruce or Neil.

Trond


On Fri, 2007-10-26 at 13:31 -0400, Chuck Lever wrote:
> Make sure we compare an unsigned length to an unsigned count in
> read_flush().
>
> Signed-off-by: Chuck Lever <[email protected]>
> ---
>
> net/sunrpc/cache.c | 10 +++++-----
> 1 files changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
> index 8e05557..578084f 100644
> --- a/net/sunrpc/cache.c
> +++ b/net/sunrpc/cache.c
> @@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,
> struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
> char tbuf[20];
> unsigned long p = *ppos;
> - int len;
> + size_t len;
>
> sprintf(tbuf, "%lu\n", cd->flush_time);
> len = strlen(tbuf);
> if (p >= len)
> return 0;
> len -= p;
> - if (len > count) len = count;
> + if (len > count)
> + len = count;
> if (copy_to_user(buf, (void*)(tbuf+p), len))
> - len = -EFAULT;
> - else
> - *ppos += len;
> + return -EFAULT;
> + *ppos += len;
> return len;
> }
>
>


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

2007-10-26 18:49:56

by J. Bruce Fields

[permalink] [raw]
Subject: Re: [PATCH 08/27] SUNRPC: Prevent length underflow in read_flush()

On Fri, Oct 26, 2007 at 01:31:20PM -0400, Chuck Lever wrote:
> Make sure we compare an unsigned length to an unsigned count in
> read_flush().

OK by me, thanks. This motivated by the hope of being able to turn on
more compile warnings some day?

--b.


>
> Signed-off-by: Chuck Lever <[email protected]>
> ---
>
> net/sunrpc/cache.c | 10 +++++-----
> 1 files changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
> index 8e05557..578084f 100644
> --- a/net/sunrpc/cache.c
> +++ b/net/sunrpc/cache.c
> @@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,
> struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
> char tbuf[20];
> unsigned long p = *ppos;
> - int len;
> + size_t len;
>
> sprintf(tbuf, "%lu\n", cd->flush_time);
> len = strlen(tbuf);
> if (p >= len)
> return 0;
> len -= p;
> - if (len > count) len = count;
> + if (len > count)
> + len = count;
> if (copy_to_user(buf, (void*)(tbuf+p), len))
> - len = -EFAULT;
> - else
> - *ppos += len;
> + return -EFAULT;
> + *ppos += len;
> return len;
> }
>
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems? Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >> http://get.splunk.com/
> _______________________________________________
> NFS maillist - [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfs

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs