Commit ef4356bf authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

staging: lustre: potential underflow in mdc_iocontrol()

Smatch complains that "data->ioc_plen2" is a user controlled value and,
since we cast to signed int, the limit check can underflow.  It's not
very serious because probably the copy_to_user() would return -EFAULT
on every arch that matters instead of creating an info leak.  Also I
haven't followed it through to see if the value is really user
controlled.

But definitely it would be safer to cast to unsigned so let's do that.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d372a4cd
...@@ -1908,8 +1908,8 @@ static int mdc_iocontrol(unsigned int cmd, struct obd_export *exp, int len, ...@@ -1908,8 +1908,8 @@ static int mdc_iocontrol(unsigned int cmd, struct obd_export *exp, int len,
/* copy UUID */ /* copy UUID */
if (copy_to_user(data->ioc_pbuf2, obd2cli_tgt(obd), if (copy_to_user(data->ioc_pbuf2, obd2cli_tgt(obd),
min((int) data->ioc_plen2, min_t(size_t, data->ioc_plen2,
(int) sizeof(struct obd_uuid)))) { sizeof(struct obd_uuid)))) {
rc = -EFAULT; rc = -EFAULT;
goto out; goto out;
} }
...@@ -1921,8 +1921,8 @@ static int mdc_iocontrol(unsigned int cmd, struct obd_export *exp, int len, ...@@ -1921,8 +1921,8 @@ static int mdc_iocontrol(unsigned int cmd, struct obd_export *exp, int len,
goto out; goto out;
if (copy_to_user(data->ioc_pbuf1, &stat_buf, if (copy_to_user(data->ioc_pbuf1, &stat_buf,
min((int) data->ioc_plen1, min_t(size_t, data->ioc_plen1,
(int) sizeof(stat_buf)))) { sizeof(stat_buf)))) {
rc = -EFAULT; rc = -EFAULT;
goto out; goto out;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment