[PATCH 08/27] SUNRPC: Prevent length underflow in read_flush()

[PATCH 08/27] SUNRPC: Prevent length underflow in read_flush()

[Chuck Lever]

Make sure we compare an unsigned length to an unsigned count in
read_flush().

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---

 net/sunrpc/cache.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 8e05557..578084f 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,
 	struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
 	char tbuf[20];
 	unsigned long p = *ppos;
-	int len;
+	size_t len;
 
 	sprintf(tbuf, "%lu\n", cd->flush_time);
 	len = strlen(tbuf);
 	if (p >= len)
 		return 0;
 	len -= p;
-	if (len > count) len = count;
+	if (len > count)
+		len = count;
 	if (copy_to_user(buf, (void*)(tbuf+p), len))
-		len = -EFAULT;
-	else
-		*ppos += len;
+		return -EFAULT;
+	*ppos += len;
 	return len;
 }
 


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: [PATCH 08/27] SUNRPC: Prevent length underflow in read_flush()

[Trond Myklebust]

This one needs to go through Bruce or Neil.

Trond


On Fri, 2007-10-26 at 13:31 -0400, Chuck Lever wrote:
> Make sure we compare an unsigned length to an unsigned count in
> read_flush().
> 
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> ---
> 
>  net/sunrpc/cache.c |   10 +++++-----
>  1 files changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
> index 8e05557..578084f 100644
> --- a/net/sunrpc/cache.c
> +++ b/net/sunrpc/cache.c
> @@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,
>  	struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
>  	char tbuf[20];
>  	unsigned long p = *ppos;
> -	int len;
> +	size_t len;
>  
>  	sprintf(tbuf, "%lu\n", cd->flush_time);
>  	len = strlen(tbuf);
>  	if (p >= len)
>  		return 0;
>  	len -= p;
> -	if (len > count) len = count;
> +	if (len > count)
> +		len = count;
>  	if (copy_to_user(buf, (void*)(tbuf+p), len))
> -		len = -EFAULT;
> -	else
> -		*ppos += len;
> +		return -EFAULT;
> +	*ppos += len;
>  	return len;
>  }
>  
> 


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: [PATCH 08/27] SUNRPC: Prevent length underflow in read_flush()

[J. Bruce Fields]

On Fri, Oct 26, 2007 at 01:31:20PM -0400, Chuck Lever wrote:
> Make sure we compare an unsigned length to an unsigned count in
> read_flush().

OK by me, thanks.  This motivated by the hope of being able to turn on
more compile warnings some day?

--b.


> 
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> ---
> 
>  net/sunrpc/cache.c |   10 +++++-----
>  1 files changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
> index 8e05557..578084f 100644
> --- a/net/sunrpc/cache.c
> +++ b/net/sunrpc/cache.c
> @@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,
>  	struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
>  	char tbuf[20];
>  	unsigned long p = *ppos;
> -	int len;
> +	size_t len;
>  
>  	sprintf(tbuf, "%lu\n", cd->flush_time);
>  	len = strlen(tbuf);
>  	if (p >= len)
>  		return 0;
>  	len -= p;
> -	if (len > count) len = count;
> +	if (len > count)
> +		len = count;
>  	if (copy_to_user(buf, (void*)(tbuf+p), len))
> -		len = -EFAULT;
> -	else
> -		*ppos += len;
> +		return -EFAULT;
> +	*ppos += len;
>  	return len;
>  }
>  
> 
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >> http://get.splunk.com/
> _______________________________________________
> NFS maillist  -  NFS@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfs

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: [PATCH 08/27] SUNRPC: Prevent length underflow in read_flush()

[Chuck Lever]

[-- Attachment #1: Type: text/plain, Size: 1830 bytes --]

J. Bruce Fields wrote:
> On Fri, Oct 26, 2007 at 01:31:20PM -0400, Chuck Lever wrote:
>> Make sure we compare an unsigned length to an unsigned count in
>> read_flush().
> 
> OK by me, thanks.  This motivated by the hope of being able to turn on
> more compile warnings some day?

The long-term goal is cleaner, less buggy code overall.  One tactic to 
reach this goal is enabling the use of automated code checking tools.

>> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
>> ---
>>
>>  net/sunrpc/cache.c |   10 +++++-----
>>  1 files changed, 5 insertions(+), 5 deletions(-)
>>
>> diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
>> index 8e05557..578084f 100644
>> --- a/net/sunrpc/cache.c
>> +++ b/net/sunrpc/cache.c
>> @@ -1242,18 +1242,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,
>>  	struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
>>  	char tbuf[20];
>>  	unsigned long p = *ppos;
>> -	int len;
>> +	size_t len;
>>  
>>  	sprintf(tbuf, "%lu\n", cd->flush_time);
>>  	len = strlen(tbuf);
>>  	if (p >= len)
>>  		return 0;
>>  	len -= p;
>> -	if (len > count) len = count;
>> +	if (len > count)
>> +		len = count;
>>  	if (copy_to_user(buf, (void*)(tbuf+p), len))
>> -		len = -EFAULT;
>> -	else
>> -		*ppos += len;
>> +		return -EFAULT;
>> +	*ppos += len;
>>  	return len;
>>  }
>>  
>>
>>
>> -------------------------------------------------------------------------
>> This SF.net email is sponsored by: Splunk Inc.
>> Still grepping through log files to find problems?  Stop.
>> Now Search log events and configuration files using AJAX and a browser.
>> Download your FREE copy of Splunk now >> http://get.splunk.com/
>> _______________________________________________
>> NFS maillist  -  NFS@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/nfs

[-- Attachment #2: chuck.lever.vcf --]
[-- Type: text/x-vcard, Size: 259 bytes --]

begin:vcard
fn:Chuck Lever
n:Lever;Chuck
org:Oracle Corporation;Corporate Architecture: Linux Projects Group
adr:;;1015 Granger Avenue;Ann Arbor;MI;48104;USA
title:Principal Member of Staff
tel;work:+1 248 614 5091
x-mozilla-html:FALSE
version:2.1
end:vcard


[-- Attachment #3: Type: text/plain, Size: 314 bytes --]

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/

[-- Attachment #4: Type: text/plain, Size: 140 bytes --]

_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs