Skip to content

Commit

Permalink
proc: avoid integer type confusion in get_proc_long
Browse files Browse the repository at this point in the history
commit e6cfaf3 upstream.

proc_get_long() is passed a size_t, but then assigns it to an 'int'
variable for the length.  Let's not do that, even if our IO paths are
limited to MAX_RW_COUNT (exactly because of these kinds of type errors).

So do the proper test in the rigth type.

Reported-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Linus Torvalds authored and Greg Kroah-Hartman committed Dec 8, 2022
1 parent 4a4073a commit 3eb9213
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions kernel/sysctl.c
Original file line number Diff line number Diff line change
Expand Up @@ -454,13 +454,12 @@ static int proc_get_long(char **buf, size_t *size,
unsigned long *val, bool *neg,
const char *perm_tr, unsigned perm_tr_len, char *tr)
{
int len;
char *p, tmp[TMPBUFLEN];
ssize_t len = *size;

if (!*size)
if (len <= 0)
return -EINVAL;

len = *size;
if (len > TMPBUFLEN - 1)
len = TMPBUFLEN - 1;

Expand Down

0 comments on commit 3eb9213

Please sign in to comment.