[140/192] proc: Avoid mixing integer types in mem_rw()

Commit Message

Andrew Morton July 1, 2021, 1:54 a.m. UTC

From: Marcelo Henrique Cerri <[e-mail]>
Subject: proc: Avoid mixing integer types in mem_rw()

Use size_t when capping the count argument received by mem_rw(). Since
count is size_t, using min_t(int, ...) can lead to a negative value
that will later be passed to access_remote_vm(), which can cause
unexpected behavior.

Since we are capping the value to at maximum PAGE_SIZE, the conversion
from size_t to int when passing it to access_remote_vm() as "len"
shouldn't be a problem.

Link: https://lkml.kernel.org/r/[e-mail]
Reviewed-by: David Disseldorp <[e-mail]>
Signed-off-by: Thadeu Lima de Souza Cascardo <[e-mail]>
Signed-off-by: Marcelo Henrique Cerri <[e-mail]>
Cc: Alexey Dobriyan <[e-mail]>
Cc: Souza Cascardo <[e-mail]>
Cc: Christian Brauner <[e-mail]>
Cc: Michel Lespinasse <[e-mail]>
Cc: Helge Deller <[e-mail]>
Cc: Oleg Nesterov <[e-mail]>
Cc: Lorenzo Stoakes <[e-mail]>
Signed-off-by: Andrew Morton <[e-mail]>
---

 fs/proc/base.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch

--- a/fs/proc/base.c~proc-avoid-mixing-integer-types-in-mem_rw
+++ a/fs/proc/base.c
@@ -854,7 +854,7 @@  static ssize_t mem_rw(struct file *file,
 	flags = FOLL_FORCE | (write ? FOLL_WRITE : 0);
 
 	while (count > 0) {
-		int this_len = min_t(int, count, PAGE_SIZE);
+		size_t this_len = min_t(size_t, count, PAGE_SIZE);
 
 		if (write && copy_from_user(page, buf, this_len)) {
 			copied = -EFAULT;