aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChuck Lever <chuck.lever@oracle.com>2007-10-26 13:31:20 -0400
committerJ. Bruce Fields <bfields@citi.umich.edu>2008-02-01 16:42:02 -0500
commit01b2969a8528b926f5e4d98161ae37053234475c (patch)
tree942fbf141743721476a3d79aa7b920ab9e72910f
parentd4395e03fec0895d01451904b8a2276ceda663c9 (diff)
SUNRPC: Prevent length underflow in read_flush()
Make sure we compare an unsigned length to an unsigned count in read_flush(). Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
-rw-r--r--net/sunrpc/cache.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 73f053d0cc7..d27bbe0ee90 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1244,18 +1244,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,
struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
char tbuf[20];
unsigned long p = *ppos;
- int len;
+ size_t len;
sprintf(tbuf, "%lu\n", cd->flush_time);
len = strlen(tbuf);
if (p >= len)
return 0;
len -= p;
- if (len > count) len = count;
+ if (len > count)
+ len = count;
if (copy_to_user(buf, (void*)(tbuf+p), len))
- len = -EFAULT;
- else
- *ppos += len;
+ return -EFAULT;
+ *ppos += len;
return len;
}