diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2007-10-26 13:31:20 -0400 |
|---|---|---|
| committer | J. Bruce Fields <bfields@citi.umich.edu> | 2008-02-01 16:42:02 -0500 |
| commit | 01b2969a8528b926f5e4d98161ae37053234475c (patch) | |
| tree | 942fbf141743721476a3d79aa7b920ab9e72910f | |
| parent | d4395e03fec0895d01451904b8a2276ceda663c9 (diff) | |
SUNRPC: Prevent length underflow in read_flush()
Make sure we compare an unsigned length to an unsigned count in
read_flush().
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
| -rw-r--r-- | net/sunrpc/cache.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c index 73f053d0cc7..d27bbe0ee90 100644 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -1244,18 +1244,18 @@ static ssize_t read_flush(struct file *file, char __user *buf, struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data; char tbuf[20]; unsigned long p = *ppos; - int len; + size_t len; sprintf(tbuf, "%lu\n", cd->flush_time); len = strlen(tbuf); if (p >= len) return 0; len -= p; - if (len > count) len = count; + if (len > count) + len = count; if (copy_to_user(buf, (void*)(tbuf+p), len)) - len = -EFAULT; - else - *ppos += len; + return -EFAULT; + *ppos += len; return len; } |