SUNRPC: Prevent length underflow in read_flush()
Subsystems (3)
PATCH 8/27 SUNRPC: Prevent length underflow in read_flush()
Make sure we compare an unsigned length to an unsigned count in read_flush().
---
net/sunrpc/cache.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-)
net/sunrpc/cache.c +5 -5
@@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,struct cache_detail *cd =PDE (file->f_path.dentry->d_inode)->data;char tbuf[20 ];unsigned long p = *ppos; -int len; +size_t len;sprintf (tbuf,"%lu\n" , cd->flush_time); len =strlen (tbuf);if (p >= len)return 0 ; len -= p; -if (len > count) len = count; +if (len > count) + len = count;if (copy_to_user (buf, (void *)(tbuf+p), len)) - len = -EFAULT ; -else - *ppos += len; +return -EFAULT ; + *ppos += len;return len; }
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs
This one needs to go through Bruce or Neil.
Trond
Quoted 28 lines · Chuck Lever
Make sure we compare an unsigned length to an unsigned count in
read_flush().Signed-off-by Chuck Lever <[email protected]>---
net/sunrpc/cache.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-)net/sunrpc/cache.c +2
-2@@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,struct cache_detail *cd =PDE (file->f_path.dentry->d_inode)->data;char tbuf[20 ];unsigned long p = *ppos; -int len; +size_t len;sprintf (tbuf,"%lu\n" , cd->flush_time); len =strlen (tbuf);if (p >= len)return 0 ; len -= p; -if (len > count) len = count; +if (len > count)
net/sunrpc/cache.c static ssize_t read_flush(struct file *file, char __user *buf, · line 1259
Quoted 10 lines
net/sunrpc/cache.c +3
-3+ len = count;if (copy_to_user (buf, (void *)(tbuf+p), len)) - len = -EFAULT ; -else - *ppos += len; +return -EFAULT ; + *ppos += len;return len; }
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs
Quoted 2 lines · Chuck Lever
Make sure we compare an unsigned length to an unsigned count in
read_flush().
OK by me, thanks. This motivated by the hope of being able to turn on more compile warnings some day?
--b.
Quoted 38 lines
Signed-off-by Chuck Lever <[email protected]>---
net/sunrpc/cache.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-)net/sunrpc/cache.c +5
-6@@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,struct cache_detail *cd =PDE (file->f_path.dentry->d_inode)->data;char tbuf[20 ];unsigned long p = *ppos; -int len; +size_t len;sprintf (tbuf,"%lu\n" , cd->flush_time); len =strlen (tbuf);if (p >= len)return 0 ; len -= p; -if (len > count) len = count; +if (len > count) + len = count;if (copy_to_user (buf, (void *)(tbuf+p), len)) - len = -EFAULT ; -else - *ppos += len; +return -EFAULT ; + *ppos += len;return len; } -------------------------------------------------------------------------
Quoted 7 lines
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs
Quoted 6 lines · J. Bruce Fields
Quoted 2 lines · Chuck Lever
Make sure we compare an unsigned length to an unsigned count in
read_flush().OK by me, thanks. This motivated by the hope of being able to turn on more compile warnings some day?
The long-term goal is cleaner, less buggy code overall. One tactic to reach this goal is enabling the use of automated code checking tools.
Quoted 36 lines
Quoted 36 lines
Signed-off-by Chuck Lever <[email protected]>---
net/sunrpc/cache.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-)net/sunrpc/cache.c +5
-5@@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,struct cache_detail *cd =PDE (file->f_path.dentry->d_inode)->data;char tbuf[20 ];unsigned long p = *ppos; -int len; +size_t len;sprintf (tbuf,"%lu\n" , cd->flush_time); len =strlen (tbuf);if (p >= len)return 0 ; len -= p; -if (len > count) len = count; +if (len > count) + len = count;if (copy_to_user (buf, (void *)(tbuf+p), len)) - len = -EFAULT ; -else - *ppos += len; +return -EFAULT ; + *ppos += len;return len; }
Quoted 8 lines
Quoted 8 lines
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs
begin:vcard
fn:Chuck Lever
n:Lever;Chuck
org:Oracle Corporation;Corporate Architecture: Linux Projects Group adr:;;1015 Granger Avenue;Ann Arbor;MI;48104;USA title:Principal Member of Staff
tel;work:+1 248 614 5091
x-mozilla-html:FALSE
version:2.1
end:vcard
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs