staging: lustre: potential underflow in mdc_iocontrol()
Smatch complains that "data->ioc_plen2" is a user controlled value and, since we cast to signed int, the limit check can underflow. It's not very serious because probably the copy_to_user() would return -EFAULT on every arch that matters instead of creating an info leak. Also I haven't followed it through to see if the value is really user controlled. But definitely it would be safer to cast to unsigned so let's do that. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Родитель
d372a4cdfa
Коммит
ef4356bf0c
|
@ -1908,8 +1908,8 @@ static int mdc_iocontrol(unsigned int cmd, struct obd_export *exp, int len,
|
||||||
|
|
||||||
/* copy UUID */
|
/* copy UUID */
|
||||||
if (copy_to_user(data->ioc_pbuf2, obd2cli_tgt(obd),
|
if (copy_to_user(data->ioc_pbuf2, obd2cli_tgt(obd),
|
||||||
min((int) data->ioc_plen2,
|
min_t(size_t, data->ioc_plen2,
|
||||||
(int) sizeof(struct obd_uuid)))) {
|
sizeof(struct obd_uuid)))) {
|
||||||
rc = -EFAULT;
|
rc = -EFAULT;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
@ -1921,8 +1921,8 @@ static int mdc_iocontrol(unsigned int cmd, struct obd_export *exp, int len,
|
||||||
goto out;
|
goto out;
|
||||||
|
|
||||||
if (copy_to_user(data->ioc_pbuf1, &stat_buf,
|
if (copy_to_user(data->ioc_pbuf1, &stat_buf,
|
||||||
min((int) data->ioc_plen1,
|
min_t(size_t, data->ioc_plen1,
|
||||||
(int) sizeof(stat_buf)))) {
|
sizeof(stat_buf)))) {
|
||||||
rc = -EFAULT;
|
rc = -EFAULT;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
Загрузка…
Ссылка в новой задаче