diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-01-06 12:57:08 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-01-17 15:58:30 -0800 |
| commit | ef4356bf0cf7ed2c9aed45dd64d73538da023718 (patch) | |
| tree | 219d275385ec5b9fde9651cd799f57f1eea95b13 | |
| parent | d372a4cdfaa62943286a0da338c2b18c7d55a1b3 (diff) | |
staging: lustre: potential underflow in mdc_iocontrol()
Smatch complains that "data->ioc_plen2" is a user controlled value and,
since we cast to signed int, the limit check can underflow. It's not
very serious because probably the copy_to_user() would return -EFAULT
on every arch that matters instead of creating an info leak. Also I
haven't followed it through to see if the value is really user
controlled.
But definitely it would be safer to cast to unsigned so let's do that.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/lustre/lustre/mdc/mdc_request.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/staging/lustre/lustre/mdc/mdc_request.c b/drivers/staging/lustre/lustre/mdc/mdc_request.c index 3b0f245a8780..05d05ce732a9 100644 --- a/drivers/staging/lustre/lustre/mdc/mdc_request.c +++ b/drivers/staging/lustre/lustre/mdc/mdc_request.c @@ -1908,8 +1908,8 @@ static int mdc_iocontrol(unsigned int cmd, struct obd_export *exp, int len, /* copy UUID */ if (copy_to_user(data->ioc_pbuf2, obd2cli_tgt(obd), - min((int) data->ioc_plen2, - (int) sizeof(struct obd_uuid)))) { + min_t(size_t, data->ioc_plen2, + sizeof(struct obd_uuid)))) { rc = -EFAULT; goto out; } @@ -1921,8 +1921,8 @@ static int mdc_iocontrol(unsigned int cmd, struct obd_export *exp, int len, goto out; if (copy_to_user(data->ioc_pbuf1, &stat_buf, - min((int) data->ioc_plen1, - (int) sizeof(stat_buf)))) { + min_t(size_t, data->ioc_plen1, + sizeof(stat_buf)))) { rc = -EFAULT; goto out; } |