| Message ID | 99284df8-9190-4deb-ad7c-c0557614a1c8@kili.mountain (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] net: fix signedness bug in skb_splice_from_iter() | expand |
Dan Carpenter <dan.carpenter@linaro.org> wrote: > while (iter->count > 0) { > ssize_t space, nr; > - size_t off, len; > + ssize_t len; > + size_t off; Good point, but why not just move len onto the preceding line? while (iter->count > 0) { - ssize_t space, nr; - size_t off, len; + ssize_t space, nr, len; + size_t off; David
On Fri, May 26, 2023 at 02:17:38PM +0100, David Howells wrote: > Dan Carpenter <dan.carpenter@linaro.org> wrote: > > > while (iter->count > 0) { > > ssize_t space, nr; > > - size_t off, len; > > + ssize_t len; > > + size_t off; > > Good point, but why not just move len onto the preceding line? > > while (iter->count > 0) { > - ssize_t space, nr; > - size_t off, len; > + ssize_t space, nr, len; > + size_t off; Sure. Will do. regards, dan carpenter
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 653abd8a6975..57a8ba81ab39 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -6932,7 +6932,8 @@ ssize_t skb_splice_from_iter(struct sk_buff *skb, struct iov_iter *iter, while (iter->count > 0) { ssize_t space, nr; - size_t off, len; + ssize_t len; + size_t off; ret = -EMSGSIZE; space = frag_limit - skb_shinfo(skb)->nr_frags;
The "len" variable needs to be signed for the error handling to work correctly. Fixes: 2e910b95329c ("net: Add a function to splice pages into an skbuff for MSG_SPLICE_PAGES") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)