diff mbox series

net/sunrpc: Fix return value from proc_do_xprt()

Message ID 20201024145240.23245-1-alex.dewar90@gmail.com
State New
Headers show
Series net/sunrpc: Fix return value from proc_do_xprt() | expand

Commit Message

Alex Dewar Oct. 24, 2020, 2:52 p.m. UTC
Commit c09f56b8f68d ("net/sunrpc: Fix return value for sysctl
sunrpc.transports") attempted to add error checking for the call to
memory_read_from_buffer(), however its return value was assigned to a
size_t variable, so any negative values would be lost in the cast. Fix
this.

Addresses-Coverity-ID: 1498033: Control flow issues (NO_EFFECT)
Fixes: c09f56b8f68d ("net/sunrpc: Fix return value for sysctl sunrpc.transports")
Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
---
 net/sunrpc/sysctl.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

J. Bruce Fields Nov. 6, 2020, 10:07 p.m. UTC | #1
Whoops, got 3 independent patches for this and overlooked this one.  See
https://lore.kernel.org/linux-nfs/20201106205959.GB26028@fieldses.org/T/#t

--b.

On Sat, Oct 24, 2020 at 03:52:40PM +0100, Alex Dewar wrote:
> Commit c09f56b8f68d ("net/sunrpc: Fix return value for sysctl
> sunrpc.transports") attempted to add error checking for the call to
> memory_read_from_buffer(), however its return value was assigned to a
> size_t variable, so any negative values would be lost in the cast. Fix
> this.
> 
> Addresses-Coverity-ID: 1498033: Control flow issues (NO_EFFECT)
> Fixes: c09f56b8f68d ("net/sunrpc: Fix return value for sysctl sunrpc.transports")
> Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> ---
>  net/sunrpc/sysctl.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
> index a18b36b5422d..c95a2b84dd95 100644
> --- a/net/sunrpc/sysctl.c
> +++ b/net/sunrpc/sysctl.c
> @@ -62,6 +62,7 @@ rpc_unregister_sysctl(void)
>  static int proc_do_xprt(struct ctl_table *table, int write,
>  			void *buffer, size_t *lenp, loff_t *ppos)
>  {
> +	ssize_t bytes_read;
>  	char tmpbuf[256];
>  	size_t len;
>  
> @@ -70,12 +71,14 @@ static int proc_do_xprt(struct ctl_table *table, int write,
>  		return 0;
>  	}
>  	len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
> -	*lenp = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
> +	bytes_read = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
>  
> -	if (*lenp < 0) {
> +	if (bytes_read < 0) {
>  		*lenp = 0;
>  		return -EINVAL;
>  	}
> +
> +	*lenp = bytes_read;
>  	return 0;
>  }
>  
> -- 
> 2.29.1
Alex Dewar Nov. 7, 2020, 1:49 p.m. UTC | #2
On Fri, Nov 06, 2020 at 05:07:21PM -0500, J. Bruce Fields wrote:
> Whoops, got 3 independent patches for this and overlooked this one.  See
> https://lore.kernel.org/linux-nfs/20201106205959.GB26028@fieldses.org/T/#t
> 
> --b.

That looks like a cleaner fix. Thanks for looking anyhow and sorry for
the noise!

> 
> On Sat, Oct 24, 2020 at 03:52:40PM +0100, Alex Dewar wrote:
> > Commit c09f56b8f68d ("net/sunrpc: Fix return value for sysctl
> > sunrpc.transports") attempted to add error checking for the call to
> > memory_read_from_buffer(), however its return value was assigned to a
> > size_t variable, so any negative values would be lost in the cast. Fix
> > this.
> > 
> > Addresses-Coverity-ID: 1498033: Control flow issues (NO_EFFECT)
> > Fixes: c09f56b8f68d ("net/sunrpc: Fix return value for sysctl sunrpc.transports")
> > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> > ---
> >  net/sunrpc/sysctl.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> > 
> > diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
> > index a18b36b5422d..c95a2b84dd95 100644
> > --- a/net/sunrpc/sysctl.c
> > +++ b/net/sunrpc/sysctl.c
> > @@ -62,6 +62,7 @@ rpc_unregister_sysctl(void)
> >  static int proc_do_xprt(struct ctl_table *table, int write,
> >  			void *buffer, size_t *lenp, loff_t *ppos)
> >  {
> > +	ssize_t bytes_read;
> >  	char tmpbuf[256];
> >  	size_t len;
> >  
> > @@ -70,12 +71,14 @@ static int proc_do_xprt(struct ctl_table *table, int write,
> >  		return 0;
> >  	}
> >  	len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
> > -	*lenp = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
> > +	bytes_read = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
> >  
> > -	if (*lenp < 0) {
> > +	if (bytes_read < 0) {
> >  		*lenp = 0;
> >  		return -EINVAL;
> >  	}
> > +
> > +	*lenp = bytes_read;
> >  	return 0;
> >  }
> >  
> > -- 
> > 2.29.1
J. Bruce Fields Nov. 7, 2020, 3:39 p.m. UTC | #3
On Sat, Nov 07, 2020 at 01:49:40PM +0000, Alex Dewar wrote:
> On Fri, Nov 06, 2020 at 05:07:21PM -0500, J. Bruce Fields wrote:
> > Whoops, got 3 independent patches for this and overlooked this one.  See
> > https://lore.kernel.org/linux-nfs/20201106205959.GB26028@fieldses.org/T/#t
> > 
> > --b.
> 
> That looks like a cleaner fix. Thanks for looking anyhow and sorry for
> the noise!

Not noise, all these efforts are appreciated.---b.

> 
> > 
> > On Sat, Oct 24, 2020 at 03:52:40PM +0100, Alex Dewar wrote:
> > > Commit c09f56b8f68d ("net/sunrpc: Fix return value for sysctl
> > > sunrpc.transports") attempted to add error checking for the call to
> > > memory_read_from_buffer(), however its return value was assigned to a
> > > size_t variable, so any negative values would be lost in the cast. Fix
> > > this.
> > > 
> > > Addresses-Coverity-ID: 1498033: Control flow issues (NO_EFFECT)
> > > Fixes: c09f56b8f68d ("net/sunrpc: Fix return value for sysctl sunrpc.transports")
> > > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> > > ---
> > >  net/sunrpc/sysctl.c | 7 +++++--
> > >  1 file changed, 5 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
> > > index a18b36b5422d..c95a2b84dd95 100644
> > > --- a/net/sunrpc/sysctl.c
> > > +++ b/net/sunrpc/sysctl.c
> > > @@ -62,6 +62,7 @@ rpc_unregister_sysctl(void)
> > >  static int proc_do_xprt(struct ctl_table *table, int write,
> > >  			void *buffer, size_t *lenp, loff_t *ppos)
> > >  {
> > > +	ssize_t bytes_read;
> > >  	char tmpbuf[256];
> > >  	size_t len;
> > >  
> > > @@ -70,12 +71,14 @@ static int proc_do_xprt(struct ctl_table *table, int write,
> > >  		return 0;
> > >  	}
> > >  	len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
> > > -	*lenp = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
> > > +	bytes_read = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
> > >  
> > > -	if (*lenp < 0) {
> > > +	if (bytes_read < 0) {
> > >  		*lenp = 0;
> > >  		return -EINVAL;
> > >  	}
> > > +
> > > +	*lenp = bytes_read;
> > >  	return 0;
> > >  }
> > >  
> > > -- 
> > > 2.29.1
diff mbox series

Patch

diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index a18b36b5422d..c95a2b84dd95 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -62,6 +62,7 @@  rpc_unregister_sysctl(void)
 static int proc_do_xprt(struct ctl_table *table, int write,
 			void *buffer, size_t *lenp, loff_t *ppos)
 {
+	ssize_t bytes_read;
 	char tmpbuf[256];
 	size_t len;
 
@@ -70,12 +71,14 @@  static int proc_do_xprt(struct ctl_table *table, int write,
 		return 0;
 	}
 	len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
-	*lenp = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
+	bytes_read = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
 
-	if (*lenp < 0) {
+	if (bytes_read < 0) {
 		*lenp = 0;
 		return -EINVAL;
 	}
+
+	*lenp = bytes_read;
 	return 0;
 }