diff mbox

[-next] eventfd: type bug in eventfd_poll()

Message ID 20150119193319.GA32634@mwanda (mailing list archive)
State Not Applicable, archived
Headers show

Commit Message

Dan Carpenter Jan. 19, 2015, 7:33 p.m. UTC
Since "count" is an unsigned int, then these conditions are never true:

        if (count == ULLONG_MAX)
                events |= POLLERR;
        if (ULLONG_MAX - 1 > count)
                events |= POLLOUT;

It should be a u64, because that's what ctx->count is.  Also GCC
complains that "flags" is unused.

Fixes: a90de8a54127 ('eventfd: don't take the spinlock in eventfd_poll')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Chris Mason Jan. 19, 2015, 7:41 p.m. UTC | #1
On Mon, Jan 19, 2015 at 2:33 PM, Dan Carpenter 
<dan.carpenter@oracle.com> wrote:
> Since "count" is an unsigned int, then these conditions are never 
> true:
> 
>         if (count == ULLONG_MAX)
>                 events |= POLLERR;
>         if (ULLONG_MAX - 1 > count)
>                 events |= POLLOUT;
> 
> It should be a u64, because that's what ctx->count is.  Also GCC
> complains that "flags" is unused.

Ugh, thanks Dan, I copied the unsigned int out of eventfd_file_create 
instead of checking the struct.  I'll test v3.

-chris



--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/fs/eventfd.c b/fs/eventfd.c
index 439e6f0..8d0c0df 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -118,8 +118,7 @@  static unsigned int eventfd_poll(struct file *file, poll_table *wait)
 {
 	struct eventfd_ctx *ctx = file->private_data;
 	unsigned int events = 0;
-	unsigned long flags;
-	unsigned int count;
+	u64 count;
 
 	poll_wait(file, &ctx->wqh, wait);
 	smp_rmb();