Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 01b2969a authored by Chuck Lever's avatar Chuck Lever Committed by J. Bruce Fields
Browse files

SUNRPC: Prevent length underflow in read_flush() 



Make sure we compare an unsigned length to an unsigned count in
read_flush().

Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
parent d4395e03

net/sunrpc/cache.c

+5 −5
Original line number Original line Diff line number Diff line
@@ -1244,17 +1244,17 @@ static ssize_t read_flush(struct file *file, char __user *buf, 
	struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;

	struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;

	char tbuf[20];

	char tbuf[20];

	unsigned long p = *ppos;

	unsigned long p = *ppos;

	int len;

	size_t len;





	sprintf(tbuf, "%lu\n", cd->flush_time);

	sprintf(tbuf, "%lu\n", cd->flush_time);

	len = strlen(tbuf);

	len = strlen(tbuf);

	if (p >= len)

	if (p >= len)

		return 0;

		return 0;

	len -= p;

	len -= p;

	if (len > count) len = count;

	if (len > count)

		len = count;

	if (copy_to_user(buf, (void*)(tbuf+p), len))

	if (copy_to_user(buf, (void*)(tbuf+p), len))

		len = -EFAULT;

		return -EFAULT;

	else

	*ppos += len;

	*ppos += len;

	return len;

	return len;

}

}