Skip to contentSkip to conversation

tcp: '< 0' test on unsigned

PATCH Applied Roel Kluin 3 participants 5 messages Mar 1, 2009 – Mar 13, 2009

Subsystems (3)
Networking Network drivers TCP
lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 tcp: '< 0' test on unsigned

or should this be fixed, with

        if (!buf || len > x)

if so, what should x be?

This patch wasn't tested in any way. ------------------------------>8-------------8<--------------------------------- len is unsigned, so the '< 0' test won't work.

Signed-off-by Roel Kluin <[email protected]>

---

net/ipv4/tcp_probe.c +1 -1
index 25524d4..0b9d63f 100644
@@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 {
 	int error = 0, cnt = 0;
 
-	if (!buf || len < 0)
+	if (!buf || (ssize_t)len < 0)
 		return -EINVAL;
 
 	while (cnt < len) {
#1 lore raw
Quoted 6 lines · Roel Kluin
net/ipv4/tcp_probe.c +0 -0
index 25524d4..0b9d63f 100644

net/ipv4/tcp_probe.c static ssize_t tcpprobe_read(struct file *file, char __user *buf, · line 173

Quoted 8 lines
net/ipv4/tcp_probe.c +1 -1
@@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 {
       int error = 0, cnt = 0;
 
-       if (!buf || len < 0)
+       if (!buf || (ssize_t)len < 0)
               return -EINVAL;
 
       while (cnt < len) {

Either cnt needs to be promoted, or you need to limit len to INT_MAX.

Cheers,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
maintainer
#2 lore raw

From: Herbert Xu <[email protected]>
Date: Mon, 2 Mar 2009 12:30:56 +0800

Quoted 10 lines
Quoted 9 lines · Roel Kluin
net/ipv4/tcp_probe.c +0 -0
index 25524d4..0b9d63f 100644
@@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 {
       int error = 0, cnt = 0;
Quoted 7 lines

net/ipv4/tcp_probe.c static ssize_t tcpprobe_read(struct file *file, char __user *buf, · line 173

Quoted 5 lines
net/ipv4/tcp_probe.c +1 -1
-       if (!buf || len < 0)
+       if (!buf || (ssize_t)len < 0)
               return -EINVAL;
 
       while (cnt < len) {

Either cnt needs to be promoted, or you need to limit len to INT_MAX.

Right, since the positive range of 'size_t' can exceed that of 'int'

author
#3 lore raw
Quoted 12 lines · David Miller

From: Herbert Xu <[email protected]>
Date: Mon, 2 Mar 2009 12:30:56 +0800

Quoted 9 lines
Quoted 8 lines · Roel Kluin
net/ipv4/tcp_probe.c +0 -0
index 25524d4..0b9d63f 100644
@@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 {
       int error = 0, cnt = 0;
Quoted 8 lines
Quoted 6 lines

net/ipv4/tcp_probe.c static ssize_t tcpprobe_read(struct file *file, char __user *buf, · line 173

Quoted 5 lines
net/ipv4/tcp_probe.c +1 -1
-       if (!buf || len < 0)
+       if (!buf || (ssize_t)len < 0)
               return -EINVAL;
 
       while (cnt < len) {

Either cnt needs to be promoted, or you need to limit len to INT_MAX.

Right, since the positive range of 'size_t' can exceed that of 'int'

like this then? ------------------------------>8-------------8<--------------------------------- promote 'cnt' to size_t, to match 'len'.

Signed-off-by Roel Kluin <[email protected]>

---

net/ipv4/tcp_probe.c +3 -2
index 25524d4..59f5b5e 100644
@@ -165,9 +165,10 @@ static int tcpprobe_sprint(char *tbuf, int n)
 static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 			     size_t len, loff_t *ppos)
 {
-	int error = 0, cnt = 0;
+	int error = 0;
+	size_t cnt = 0;
 
-	if (!buf || len < 0)
+	if (!buf)
 		return -EINVAL;
 
 	while (cnt < len) {
maintainer Applied
#4 lore raw

From: Roel Kluin <[email protected]>
Date: Mon, 02 Mar 2009 13:24:52 +0100

Quoted 6 lines
Quoted 5 lines · David Miller

From: Herbert Xu <[email protected]>
Date: Mon, 2 Mar 2009 12:30:56 +0800

Quoted 1 line

Either cnt needs to be promoted, or you need to limit len to INT_MAX.

Quoted 7 lines
Quoted 1 line

Right, since the positive range of 'size_t' can exceed that of 'int'

like this then? ------------------------------>8-------------8<--------------------------------- promote 'cnt' to size_t, to match 'len'.

Signed-off-by Roel Kluin <[email protected]>

Applied, thanks.