mirror of
				https://github.com/torvalds/linux.git
				synced 2025-11-04 02:30:34 +02:00 
			
		
		
		
	io_uring: fix types in io_recvmsg_multishot_overflow
io_recvmsg_multishot_overflow had incorrect types on non x64 system.
But also it had an unnecessary INT_MAX check, which could just be done
by changing the type of the accumulator to int (also simplifying the
casts).
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Fixes: a8b38c4ce724 ("io_uring: support multishot in recvmsg")
Signed-off-by: Dylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220715130252.610639-1-dylany@fb.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
			
			
This commit is contained in:
		
							parent
							
								
									4ccc6db090
								
							
						
					
					
						commit
						9b0fc3c054
					
				
					 1 changed files with 5 additions and 5 deletions
				
			
		| 
						 | 
					@ -327,14 +327,14 @@ int io_send(struct io_kiocb *req, unsigned int issue_flags)
 | 
				
			||||||
 | 
					
 | 
				
			||||||
static bool io_recvmsg_multishot_overflow(struct io_async_msghdr *iomsg)
 | 
					static bool io_recvmsg_multishot_overflow(struct io_async_msghdr *iomsg)
 | 
				
			||||||
{
 | 
					{
 | 
				
			||||||
	unsigned long hdr;
 | 
						int hdr;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	if (check_add_overflow(sizeof(struct io_uring_recvmsg_out),
 | 
						if (iomsg->namelen < 0)
 | 
				
			||||||
			       (unsigned long)iomsg->namelen, &hdr))
 | 
					 | 
				
			||||||
		return true;
 | 
							return true;
 | 
				
			||||||
	if (check_add_overflow(hdr, iomsg->controllen, &hdr))
 | 
						if (check_add_overflow((int)sizeof(struct io_uring_recvmsg_out),
 | 
				
			||||||
 | 
								       iomsg->namelen, &hdr))
 | 
				
			||||||
		return true;
 | 
							return true;
 | 
				
			||||||
	if (hdr > INT_MAX)
 | 
						if (check_add_overflow(hdr, (int)iomsg->controllen, &hdr))
 | 
				
			||||||
		return true;
 | 
							return true;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	return false;
 | 
						return false;
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
		Reference in a new issue