* [PATCH] tcp: '< 0' test on unsigned
@ 2009-03-01 21:09 Roel Kluin
2009-03-02 4:30 ` Herbert Xu
0 siblings, 1 reply; 5+ messages in thread
From: Roel Kluin @ 2009-03-01 21:09 UTC (permalink / raw)
To: David S. Miller; +Cc: netdev, Andrew Morton
or should this be fixed, with
if (!buf || len > x)
if so, what should x be?
This patch wasn't tested in any way.
------------------------------>8-------------8<---------------------------------
len is unsigned, so the '< 0' test won't work.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 25524d4..0b9d63f 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
{
int error = 0, cnt = 0;
- if (!buf || len < 0)
+ if (!buf || (ssize_t)len < 0)
return -EINVAL;
while (cnt < len) {
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] tcp: '< 0' test on unsigned
2009-03-01 21:09 [PATCH] tcp: '< 0' test on unsigned Roel Kluin
@ 2009-03-02 4:30 ` Herbert Xu
2009-03-02 4:36 ` David Miller
0 siblings, 1 reply; 5+ messages in thread
From: Herbert Xu @ 2009-03-02 4:30 UTC (permalink / raw)
To: Roel Kluin; +Cc: davem, netdev, akpm
Roel Kluin <roel.kluin@gmail.com> wrote:
>
> diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
> index 25524d4..0b9d63f 100644
> --- a/net/ipv4/tcp_probe.c
> +++ b/net/ipv4/tcp_probe.c
> @@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
> {
> int error = 0, cnt = 0;
>
> - if (!buf || len < 0)
> + if (!buf || (ssize_t)len < 0)
> return -EINVAL;
>
> while (cnt < len) {
Either cnt needs to be promoted, or you need to limit len to INT_MAX.
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] tcp: '< 0' test on unsigned
2009-03-02 4:30 ` Herbert Xu
@ 2009-03-02 4:36 ` David Miller
2009-03-02 12:24 ` Roel Kluin
0 siblings, 1 reply; 5+ messages in thread
From: David Miller @ 2009-03-02 4:36 UTC (permalink / raw)
To: herbert; +Cc: roel.kluin, netdev, akpm
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Mon, 2 Mar 2009 12:30:56 +0800
> Roel Kluin <roel.kluin@gmail.com> wrote:
> >
> > diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
> > index 25524d4..0b9d63f 100644
> > --- a/net/ipv4/tcp_probe.c
> > +++ b/net/ipv4/tcp_probe.c
> > @@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
> > {
> > int error = 0, cnt = 0;
> >
> > - if (!buf || len < 0)
> > + if (!buf || (ssize_t)len < 0)
> > return -EINVAL;
> >
> > while (cnt < len) {
>
> Either cnt needs to be promoted, or you need to limit len to INT_MAX.
Right, since the positive range of 'size_t' can exceed that of 'int'
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] tcp: '< 0' test on unsigned
2009-03-02 4:36 ` David Miller
@ 2009-03-02 12:24 ` Roel Kluin
2009-03-13 23:05 ` David Miller
0 siblings, 1 reply; 5+ messages in thread
From: Roel Kluin @ 2009-03-02 12:24 UTC (permalink / raw)
To: David Miller; +Cc: herbert, netdev, akpm
David Miller wrote:
> From: Herbert Xu <herbert@gondor.apana.org.au>
> Date: Mon, 2 Mar 2009 12:30:56 +0800
>
>> Roel Kluin <roel.kluin@gmail.com> wrote:
>>> diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
>>> index 25524d4..0b9d63f 100644
>>> --- a/net/ipv4/tcp_probe.c
>>> +++ b/net/ipv4/tcp_probe.c
>>> @@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
>>> {
>>> int error = 0, cnt = 0;
>>>
>>> - if (!buf || len < 0)
>>> + if (!buf || (ssize_t)len < 0)
>>> return -EINVAL;
>>>
>>> while (cnt < len) {
>> Either cnt needs to be promoted, or you need to limit len to INT_MAX.
>
> Right, since the positive range of 'size_t' can exceed that of 'int'
like this then?
------------------------------>8-------------8<---------------------------------
promote 'cnt' to size_t, to match 'len'.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 25524d4..59f5b5e 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -165,9 +165,10 @@ static int tcpprobe_sprint(char *tbuf, int n)
static ssize_t tcpprobe_read(struct file *file, char __user *buf,
size_t len, loff_t *ppos)
{
- int error = 0, cnt = 0;
+ int error = 0;
+ size_t cnt = 0;
- if (!buf || len < 0)
+ if (!buf)
return -EINVAL;
while (cnt < len) {
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] tcp: '< 0' test on unsigned
2009-03-02 12:24 ` Roel Kluin
@ 2009-03-13 23:05 ` David Miller
0 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2009-03-13 23:05 UTC (permalink / raw)
To: roel.kluin; +Cc: herbert, netdev, akpm
From: Roel Kluin <roel.kluin@gmail.com>
Date: Mon, 02 Mar 2009 13:24:52 +0100
> David Miller wrote:
> > From: Herbert Xu <herbert@gondor.apana.org.au>
> > Date: Mon, 2 Mar 2009 12:30:56 +0800
> >
> >> Either cnt needs to be promoted, or you need to limit len to INT_MAX.
> >
> > Right, since the positive range of 'size_t' can exceed that of 'int'
>
> like this then?
> ------------------------------>8-------------8<---------------------------------
> promote 'cnt' to size_t, to match 'len'.
>
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2009-03-13 23:05 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-03-01 21:09 [PATCH] tcp: '< 0' test on unsigned Roel Kluin
2009-03-02 4:30 ` Herbert Xu
2009-03-02 4:36 ` David Miller
2009-03-02 12:24 ` Roel Kluin
2009-03-13 23:05 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).