From: Chuck Lever <chuck.lever@oracle.com>
Date: Fri, 26 Oct 2007 17:31:20 +0000 (-0400)
Subject: SUNRPC: Prevent length underflow in read_flush()
X-Git-Tag: v2.6.25-rc1~1072^2~95
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=01b2969a8528b926f5e4d98161ae37053234475c;p=linux-2.6

SUNRPC: Prevent length underflow in read_flush()

Make sure we compare an unsigned length to an unsigned count in
read_flush().

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
---

diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 73f053d0cc..d27bbe0ee9 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1244,18 +1244,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,
 	struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
 	char tbuf[20];
 	unsigned long p = *ppos;
-	int len;
+	size_t len;
 
 	sprintf(tbuf, "%lu\n", cd->flush_time);
 	len = strlen(tbuf);
 	if (p >= len)
 		return 0;
 	len -= p;
-	if (len > count) len = count;
+	if (len > count)
+		len = count;
 	if (copy_to_user(buf, (void*)(tbuf+p), len))
-		len = -EFAULT;
-	else
-		*ppos += len;
+		return -EFAULT;
+	*ppos += len;
 	return len;
 }