Patchwork tcp: '< 0' test on unsigned

login
register
mail settings
Submitter roel kluin
Date March 1, 2009, 9:09 p.m.
Message ID <49AAF989.8070000@gmail.com>
Download mbox | patch
Permalink /patch/23916/
State Changes Requested
Delegated to: David Miller
Headers show

Comments

roel kluin - March 1, 2009, 9:09 p.m.
or should this be fixed, with

        if (!buf || len > x)

if so, what should x be?

This patch wasn't tested in any way.
------------------------------>8-------------8<---------------------------------
len is unsigned, so the '< 0' test won't work.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Herbert Xu - March 2, 2009, 4:30 a.m.
Roel Kluin <roel.kluin@gmail.com> wrote:
>
> diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
> index 25524d4..0b9d63f 100644
> --- a/net/ipv4/tcp_probe.c
> +++ b/net/ipv4/tcp_probe.c
> @@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
> {
>        int error = 0, cnt = 0;
> 
> -       if (!buf || len < 0)
> +       if (!buf || (ssize_t)len < 0)
>                return -EINVAL;
> 
>        while (cnt < len) {

Either cnt needs to be promoted, or you need to limit len to INT_MAX.

Cheers,
David Miller - March 2, 2009, 4:36 a.m.
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Mon, 2 Mar 2009 12:30:56 +0800

> Roel Kluin <roel.kluin@gmail.com> wrote:
> >
> > diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
> > index 25524d4..0b9d63f 100644
> > --- a/net/ipv4/tcp_probe.c
> > +++ b/net/ipv4/tcp_probe.c
> > @@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
> > {
> >        int error = 0, cnt = 0;
> > 
> > -       if (!buf || len < 0)
> > +       if (!buf || (ssize_t)len < 0)
> >                return -EINVAL;
> > 
> >        while (cnt < len) {
> 
> Either cnt needs to be promoted, or you need to limit len to INT_MAX.

Right, since the positive range of 'size_t' can exceed that of 'int'
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 25524d4..0b9d63f 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -167,7 +167,7 @@  static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 {
 	int error = 0, cnt = 0;
 
-	if (!buf || len < 0)
+	if (!buf || (ssize_t)len < 0)
 		return -EINVAL;
 
 	while (cnt < len) {