Messages in this thread Patch in this message | | | Date | Mon, 22 Jul 2002 18:15:29 +0200 | From | Marcin Dalecki <> | Subject | [PATCH] 2.5.27 read_write - take 2 |
| |
Alan Cox wrote: > On Mon, 2002-07-22 at 15:08, Marcin Dalecki wrote: > >>- It is fixing completely confused wild casting to 32 bits. >> >>- Actually adding a comment explaining the obscure code, which is >> relying on integer arithmetics overflow. > > > Better yet take the code from 2.4.19-rc3. The code you fixed up is still > wrong. Sincie iov_len is not permitted to exceed 2Gb (SuS v3, found by > the LSB test suite) the actual fix turns out to be even simpler and > cleaner than the one you did
You are right. It makes sese, since readv and writev are supposed to return ssize_t. Fixed patch version attached.
diff -urN linux-2.5.27/fs/read_write.c linux/fs/read_write.c --- linux-2.5.27/fs/read_write.c 2002-07-22 17:51:25.000000000 +0200 +++ linux/fs/read_write.c 2002-07-22 17:57:22.000000000 +0200 @@ -306,12 +306,16 @@ tot_len = 0; ret = -EINVAL; for (i = 0 ; i < count ; i++) { - size_t tmp = tot_len; - int len = iov[i].iov_len; + ssize_t tmp = tot_len; + ssize_t len = iov[i].iov_len; + + /* check for SSIZE_MAX overflow */ if (len < 0) goto out; - (u32)tot_len += len; - if (tot_len < tmp || tot_len < (u32)len) + + tot_len += len; + /* check for overflows */ + if (tot_len < tmp) goto out; } | |