[PATCH] fix in fs/proc/generic.c: comparing unsigned int

[Martin Gadbois <martin.gadbois@colubris.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In function proc_file_read(), if variable nbytes becomes "negative" it lead to a possibe overrun and
segfault.
It can become negative if the function dp->read_proc() returns n > nbytes.

When nbyte is negative, the while comparaison is unsigned (size_t nbytes), and the check is always TRUE.

This patch corrects the problem by using a int variable.

diff -ur linux-2.4.28-pre4/fs/proc/generic.c linux-2.4.28-pre4-fix/fs/proc/generic.c
- --- linux-2.4.28-pre4/fs/proc/generic.c	2004-10-22 11:40:42.000000000 -0400
+++ linux-2.4.28-pre4-fix/fs/proc/generic.c	2004-10-22 11:33:19.000000000 -0400
@@ -57,14 +57,15 @@
~ 	char	*start;
~ 	struct proc_dir_entry * dp;
~ 	loff_t pos = *ppos;
+	int bytes_left = nbytes;

~ 	dp = (struct proc_dir_entry *) inode->u.generic_ip;
~ 	if (!(page = (char*) __get_free_page(GFP_KERNEL)))
~ 		return -ENOMEM;

- -	while ((nbytes > 0) && !eof)
+	while ((bytes_left > 0) && !eof)
~ 	{
- -		count = MIN(PROC_BLOCK_SIZE, nbytes);
+		count = MIN(PROC_BLOCK_SIZE, bytes_left);
~ 		if ((unsigned)pos > INT_MAX)
~ 			break;

@@ -115,7 +116,7 @@
~ 		}

~ 		pos += start < page ? (long)start : n; /* Move down the file */
- -		nbytes -= n;
+		bytes_left -= n;
~ 		buf += n;
~ 		retval += n;
~ 	}

- --
==============         +----------------------------------------------+
Martin Gadbois         | "Politics may come and go, but Greed goes on |
S/W Developper         | forever" --Qeng Ho motto, Fire upon the Deep |
Colubris Networks Inc. +----------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBeVVV9Y3/iTTCEDkRAgjaAJ4tH4U7g/kP23DI96i8/h9jUcM/EgCfa56F
S8oRN77DrSNBMjr2b++HkO4=
=szpU
-----END PGP SIGNATURE-----