[PATCH] negative groups in netlink_setsockopt

[PATCH] negative groups in netlink_setsockopt

[Johannes Berg]

Reading netlink_setsockopt it's not immediately clear why there isn't a
bug when you pass in negative numbers, the reason being that the >=
comparison is really unsigned although 'val' is signed because
nlk->ngroups is unsigned. Make 'val' unsigned too.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>

---
 net/netlink/af_netlink.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- wireless-dev.orig/net/netlink/af_netlink.c	2007-07-17 14:05:14.580964463 +0200
+++ wireless-dev/net/netlink/af_netlink.c	2007-07-17 14:05:30.210964463 +0200
@@ -1012,7 +1012,8 @@ static int netlink_setsockopt(struct soc
 {
 	struct sock *sk = sock->sk;
 	struct netlink_sock *nlk = nlk_sk(sk);
-	int val = 0, err;
+	unsigned int val = 0;
+	int err;
 
 	if (level != SOL_NETLINK)
 		return -ENOPROTOOPT;

Re: [PATCH] negative groups in netlink_setsockopt

[David Miller]

From: Johannes Berg <johannes@sipsolutions.net>
Date: Tue, 17 Jul 2007 14:26:04 +0200

> Reading netlink_setsockopt it's not immediately clear why there isn't a
> bug when you pass in negative numbers, the reason being that the >=
> comparison is really unsigned although 'val' is signed because
> nlk->ngroups is unsigned. Make 'val' unsigned too.
> 
> Signed-off-by: Johannes Berg <johannes@sipsolutions.net>

Applied, but I updated the "(int __user *)" cast in
get_user() to match as well when applying this.

Thanks.

Re: [PATCH] negative groups in netlink_setsockopt

[Johannes Berg]

[-- Attachment #1: Type: text/plain, Size: 643 bytes --]

On Wed, 2007-07-18 at 02:08 -0700, David Miller wrote:
> From: Johannes Berg <johannes@sipsolutions.net>
> Date: Tue, 17 Jul 2007 14:26:04 +0200
> 
> > Reading netlink_setsockopt it's not immediately clear why there isn't a
> > bug when you pass in negative numbers, the reason being that the >=
> > comparison is really unsigned although 'val' is signed because
> > nlk->ngroups is unsigned. Make 'val' unsigned too.
> > 
> > Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
> 
> Applied, but I updated the "(int __user *)" cast in
> get_user() to match as well when applying this.

Oh, good catch, thanks.

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 190 bytes --]