kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/io_uring
History
Dan Carpenter 868ec86861 io_uring/net: fix overflow check in io_recvmsg_mshot_prep() 
[ Upstream commit 8ede3db506 ]

The "controllen" variable is type size_t (unsigned long).  Casting it
to int could lead to an integer underflow.

The check_add_overflow() function considers the type of the destination
which is type int.  If we add two positive values and the result cannot
fit in an integer then that's counted as an overflow.

However, if we cast "controllen" to an int and it turns negative, then
negative values *can* fit into an int type so there is no overflow.

Good: 100 + (unsigned long)-4 = 96  <-- overflow
 Bad: 100 + (int)-4 = 96 <-- no overflow

I deleted the cast of the sizeof() as well.  That's not a bug but the
cast is unnecessary.

Fixes: 9b0fc3c054 ("io_uring: fix types in io_recvmsg_multishot_overflow")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/138bd2e2-ede8-4bcc-aa7b-f3d9de167a37@moroto.mountain
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-03-26 18:20:29 -04:00
..
advise.c io_uring: make io_kiocb_to_cmd() typesafe 2022-08-12 17:01:00 -06:00
advise.h io_uring: split out fadvise/madvise operations 2022-07-24 18:39:11 -06:00
alloc_cache.h io_uring: fix poll/netmsg alloc caches 2023-04-06 12:10:52 +02:00
cancel.c io_uring/cancel: re-grab ctx mutex after finishing wait 2023-01-12 12:02:38 +01:00
cancel.h io_uring: add sync cancelation API through io_uring_register() 2022-07-24 18:39:15 -06:00
epoll.c io_uring: undeprecate epoll_ctl support 2023-06-09 10:34:23 +02:00
epoll.h io_uring: move epoll handler to its own file 2022-07-24 18:39:11 -06:00
fdinfo.c io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid 2023-11-02 09:35:29 +01:00
fdinfo.h io_uring: move fdinfo helpers to its own file 2022-07-24 18:39:12 -06:00
filetable.c io_uring: drop any code related to SCM_RIGHTS 2024-03-26 18:20:22 -04:00
filetable.h io_uring: kill hot path fixed file bitmap debug checks 2022-10-16 17:07:53 -06:00
fs.c io_uring/fs: consider link->flags when getting path for LINKAT 2023-12-03 07:32:11 +01:00
fs.h io_uring: split out filesystem related operations 2022-07-24 18:39:11 -06:00
io-wq.c io_uring/sqpoll: fix io-wq affinity when IORING_SETUP_SQPOLL is used 2023-09-19 12:27:54 +02:00
io-wq.h io_uring/sqpoll: fix io-wq affinity when IORING_SETUP_SQPOLL is used 2023-09-19 12:27:54 +02:00
io_uring.c io_uring: drop any code related to SCM_RIGHTS 2024-03-26 18:20:22 -04:00
io_uring.h io_uring/unix: drop usage of io_uring socket 2024-03-26 18:20:22 -04:00
kbuf.c io_uring/kbuf: Allow the full buffer id space for provided buffers 2023-11-20 11:52:00 +01:00
kbuf.h io_uring: allow buffer recycling in READV 2022-09-21 10:30:43 -06:00
Makefile io_uring: add zc notification infrastructure 2022-07-24 18:41:06 -06:00
msg_ring.c io_uring/msg_ring: fix missing lock on overflow for IOPOLL 2023-08-30 16:11:05 +02:00
msg_ring.h io_uring: get rid of double locking 2023-08-30 16:11:04 +02:00
net.c io_uring/net: fix overflow check in io_recvmsg_mshot_prep() 2024-03-26 18:20:29 -04:00
net.h io_uring/net: zerocopy sendmsg 2022-09-21 13:15:02 -06:00
nop.c io_uring: kill extra io_uring_types.h includes 2022-07-24 18:39:14 -06:00
nop.h io_uring: move nop into its own file 2022-07-24 18:39:11 -06:00
notif.c io_uring/net: introduce IORING_SEND_ZC_REPORT_USAGE flag 2022-12-31 13:33:11 +01:00
notif.h io_uring/net: introduce IORING_SEND_ZC_REPORT_USAGE flag 2022-12-31 13:33:11 +01:00
opdef.c io_uring: get rid of double locking 2023-08-30 16:11:04 +02:00
opdef.h io_uring: dont remove file from msg_ring reqs 2022-12-31 13:33:12 +01:00
openclose.c io_uring: correct check for O_TMPFILE 2023-08-16 18:27:24 +02:00
openclose.h io_uring: split out fixed file installation and removal 2022-07-24 18:39:16 -06:00
poll.c io_uring: always lock in io_apoll_task_func 2023-09-19 12:27:54 +02:00
poll.h io_uring/poll: allow some retries for poll triggering spuriously 2023-03-11 13:55:43 +01:00
refs.h io_uring: make io_uring_types.h public 2022-07-24 18:39:14 -06:00
rsrc.c io_uring: drop any code related to SCM_RIGHTS 2024-03-26 18:20:22 -04:00
rsrc.h io_uring: drop any code related to SCM_RIGHTS 2024-03-26 18:20:22 -04:00
rw.c io_uring/rw: ensure io->bytes_done is always initialized 2024-01-25 15:27:41 -08:00
rw.h io_uring/rw: don't lose partial IO result on fail 2022-09-21 13:15:02 -06:00
slist.h io_uring: move list helpers to a separate file 2022-07-24 18:39:15 -06:00
splice.c io_uring: make io_kiocb_to_cmd() typesafe 2022-08-12 17:01:00 -06:00
splice.h io_uring: split out splice related operations 2022-07-24 18:39:11 -06:00
sqpoll.c io_uring: Don't set affinity on a dying sqpoll thread 2023-09-19 12:27:54 +02:00
sqpoll.h io_uring/sqpoll: fix io-wq affinity when IORING_SETUP_SQPOLL is used 2023-09-19 12:27:54 +02:00
statx.c io_uring: make io_kiocb_to_cmd() typesafe 2022-08-12 17:01:00 -06:00
statx.h io_uring: move statx handling to its own file 2022-07-24 18:39:11 -06:00
sync.c io_uring: make io_kiocb_to_cmd() typesafe 2022-08-12 17:01:00 -06:00
sync.h io_uring: split out fs related sync/fallocate functions 2022-07-24 18:39:11 -06:00
tctx.c io_uring: remove io_register_submitter 2022-10-07 12:25:30 -06:00
tctx.h io_uring: simplify __io_uring_add_tctx_node 2022-10-07 12:25:30 -06:00
timeout.c io_uring: annotate offset timeout races 2023-08-11 12:08:24 +02:00
timeout.h io_uring: remove unused return from io_disarm_next 2022-09-21 13:15:01 -06:00
uring_cmd.c block/io_uring: pass in issue_flags for uring_cmd task_work handling 2023-04-06 12:10:51 +02:00
uring_cmd.h io_uring: move uring_cmd handling to its own file 2022-07-24 18:39:11 -06:00
xattr.c __io_setxattr(): constify path 2022-09-01 17:39:05 -04:00
xattr.h io_uring: move xattr related opcodes to its own file 2022-07-24 18:39:11 -06:00