Message ID | 3d17a814-2300-4902-8b2c-2a73c0e9bfc4@moroto.mountain (mailing list archive) |
---|---|
State | New |
Headers | show |
Series | io_uring/net: fix bug in io_recvmsg_mshot_prep() | expand |
On Fri, Mar 01, 2024 at 06:29:52PM +0300, Dan Carpenter wrote: > "namelen" is type size_t so it can't be negative. > > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- Jens applied Muhammad's patch so this part isn't required any more (and would introduce a bug if it were). regards, dan carpenter
On 3/1/24 9:56 AM, Dan Carpenter wrote: > On Fri, Mar 01, 2024 at 06:29:52PM +0300, Dan Carpenter wrote: >> "namelen" is type size_t so it can't be negative. >> >> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> >> --- > > Jens applied Muhammad's patch so this part isn't required any more (and > would introduce a bug if it were). Yeah good point - thanks, I've dropped it.
diff --git a/io_uring/net.c b/io_uring/net.c index da257bf429d5..04a7426c80d2 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -557,8 +557,6 @@ static int io_recvmsg_mshot_prep(struct io_kiocb *req, (REQ_F_APOLL_MULTISHOT|REQ_F_BUFFER_SELECT)) { int hdr; - if (unlikely(namelen < 0)) - return -EOVERFLOW; if (check_add_overflow(sizeof(struct io_uring_recvmsg_out), namelen, &hdr)) return -EOVERFLOW;
"namelen" is type size_t so it can't be negative. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- io_uring/net.c | 2 -- 1 file changed, 2 deletions(-)