Commit fb14ef35 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] readv/writev range checking fix

do-readv_writev() is trying to fail if

a) any of the segments have a length < 0 or

b) the sum of the segments wraps negative.

But it gets b) wrong because local variable tot_len is unsigned.

Fix that up.
parent b1ee3fea
......@@ -412,13 +412,13 @@ static ssize_t do_readv_writev(int type, struct file *file,
*/
tot_len = 0;
ret = -EINVAL;
for (seg = 0 ; seg < nr_segs; seg++) {
ssize_t tmp = tot_len;
for (seg = 0; seg < nr_segs; seg++) {
ssize_t len = (ssize_t)iov[seg].iov_len;
if (len < 0) /* size_t not fitting an ssize_t .. */
goto out;
tot_len += len;
if (tot_len < tmp) /* maths overflow on the ssize_t */
if ((ssize_t)tot_len < 0) /* maths overflow on the ssize_t */
goto out;
}
if (tot_len == 0) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment