lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SUNRPC: Prevent length underflow in read_flush()

Browse Source 
Make sure we compare an unsigned length to an unsigned count in
read_flush().

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
This commit is contained in:
Chuck Lever
2007-10-26 13:31:20 -04:00
committed by J. Bruce Fields
parent d4395e03fe
commit 01b2969a85
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
net/sunrpc/cache.c
View File

@ -1244,17 +1244,17 @@ static ssize_t read_flush(struct file *file, char __user *buf,
struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data; struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
char tbuf[20]; char tbuf[20];
unsigned long p = *ppos; unsigned long p = *ppos;
int len; size_t len;
sprintf(tbuf, "%lu\n", cd->flush_time); sprintf(tbuf, "%lu\n", cd->flush_time);
len = strlen(tbuf); len = strlen(tbuf);
if (p >= len) if (p >= len)
return 0; return 0;
len -= p; len -= p;
if (len > count) len = count; if (len > count)
len = count;
if (copy_to_user(buf, (void*)(tbuf+p), len)) if (copy_to_user(buf, (void*)(tbuf+p), len))
len = -EFAULT; return -EFAULT;
else
*ppos += len; *ppos += len;
return len; return len;
} }