From ef4356bf0cf7ed2c9aed45dd64d73538da023718 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 6 Jan 2015 12:57:08 +0300 Subject: [PATCH] staging: lustre: potential underflow in mdc_iocontrol() Smatch complains that "data->ioc_plen2" is a user controlled value and, since we cast to signed int, the limit check can underflow. It's not very serious because probably the copy_to_user() would return -EFAULT on every arch that matters instead of creating an info leak. Also I haven't followed it through to see if the value is really user controlled. But definitely it would be safer to cast to unsigned so let's do that. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- drivers/staging/lustre/lustre/mdc/mdc_request.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/staging/lustre/lustre/mdc/mdc_request.c b/drivers/staging/lustre/lustre/mdc/mdc_request.c index 3b0f245a8780..05d05ce732a9 100644 --- a/drivers/staging/lustre/lustre/mdc/mdc_request.c +++ b/drivers/staging/lustre/lustre/mdc/mdc_request.c @@ -1908,8 +1908,8 @@ static int mdc_iocontrol(unsigned int cmd, struct obd_export *exp, int len, /* copy UUID */ if (copy_to_user(data->ioc_pbuf2, obd2cli_tgt(obd), - min((int) data->ioc_plen2, - (int) sizeof(struct obd_uuid)))) { + min_t(size_t, data->ioc_plen2, + sizeof(struct obd_uuid)))) { rc = -EFAULT; goto out; } @@ -1921,8 +1921,8 @@ static int mdc_iocontrol(unsigned int cmd, struct obd_export *exp, int len, goto out; if (copy_to_user(data->ioc_pbuf1, &stat_buf, - min((int) data->ioc_plen1, - (int) sizeof(stat_buf)))) { + min_t(size_t, data->ioc_plen1, + sizeof(stat_buf)))) { rc = -EFAULT; goto out; } -- 2.45.2