[PATCH] tcp: '< 0' test on unsigned

Previous thread: 學習快速記憶法只要1600元!! by uradrobrwmrd on Sunday, March 1, 2009 - 8:52 am. (1 message)

Next thread: [PATCH] [SK_BUFF]: '< 0' and '>= 0' test on unsigned by Roel Kluin on Sunday, March 1, 2009 - 3:00 pm. (2 messages)
From: Roel Kluin
Date: Sunday, March 1, 2009 - 2:09 pm

or should this be fixed, with

        if (!buf || len &gt; x)

if so, what should x be?

This patch wasn't tested in any way.
------------------------------&gt;8-------------8&lt;---------------------------------
len is unsigned, so the '&lt; 0' test won't work.

Signed-off-by: Roel Kluin &lt;roel.kluin@gmail.com&gt;
---
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 25524d4..0b9d63f 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -167,7 +167,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 {
 	int error = 0, cnt = 0;
 
-	if (!buf || len &lt; 0)
+	if (!buf || (ssize_t)len &lt; 0)
 		return -EINVAL;
 
 	while (cnt &lt; len) {
--

From: Herbert Xu
Date: Sunday, March 1, 2009 - 9:30 pm

Either cnt needs to be promoted, or you need to limit len to INT_MAX.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV&gt;HI~} &lt;herbert@gondor.apana.org.au&gt;
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--

From: David Miller
Date: Sunday, March 1, 2009 - 9:36 pm

From: Herbert Xu &lt;herbert@gondor.apana.org.au&gt;

Right, since the positive range of 'size_t' can exceed that of 'int'
--

From: Roel Kluin
Date: Monday, March 2, 2009 - 5:24 am

like this then?
------------------------------&gt;8-------------8&lt;---------------------------------
promote 'cnt' to size_t, to match 'len'.

Signed-off-by: Roel Kluin &lt;roel.kluin@gmail.com&gt;
---
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 25524d4..59f5b5e 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -165,9 +165,10 @@ static int tcpprobe_sprint(char *tbuf, int n)
 static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 			     size_t len, loff_t *ppos)
 {
-	int error = 0, cnt = 0;
+	int error = 0;
+	size_t cnt = 0;
 
-	if (!buf || len &lt; 0)
+	if (!buf)
 		return -EINVAL;
 
 	while (cnt &lt; len) {
--

From: David Miller
Date: Friday, March 13, 2009 - 4:05 pm

From: Roel Kluin &lt;roel.kluin@gmail.com&gt;

Applied, thanks.
--

Previous thread: 學習快速記憶法只要1600元!! by uradrobrwmrd on Sunday, March 1, 2009 - 8:52 am. (1 message)

Next thread: [PATCH] [SK_BUFF]: '< 0' and '>= 0' test on unsigned by Roel Kluin on Sunday, March 1, 2009 - 3:00 pm. (2 messages)