linux-kernel - [PATCH][next] cifsd: Fix a less than zero comparison with the unsigned int nbytes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu,  7 Oct 2021 12:47:16 +0100
From:   Colin King <colin.king@...onical.com>
To:     Namjae Jeon <linkinjeon@...nel.org>,
        Sergey Senozhatsky <senozhatsky@...omium.org>,
        Steve French <sfrench@...ba.org>,
        Hyunchul Lee <hyc.lee@...il.com>,
        Ronnie Sahlberg <lsahlber@...hat.com>,
        linux-cifs@...r.kernel.org
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH][next] cifsd: Fix a less than zero comparison with the unsigned int nbytes

From: Colin Ian King <colin.king@...onical.com>

Currently the check for nbytes < 0 is always false because nbytes
is an unsigned int and can never be less than zero.  Fix this by
using ret for the assignment and comparison and assigning nbytes
to ret later if the check is successful. The fix also passes the
error return in ret to the error handling path that caters for
various values of ret.

Addresses-Coverity: ("Unsigned compared against 0")
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 fs/ksmbd/smb2pdu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index 8ceac0ebdbea..9be82d08b722 100644
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -7537,9 +7537,10 @@ int smb2_ioctl(struct ksmbd_work *work)
 		rsp->VolatileFileId = cpu_to_le64(SMB2_NO_FID);
 		break;
 	case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
-		nbytes = fsctl_query_iface_info_ioctl(conn, rsp, out_buf_len);
-		if (nbytes < 0)
+		ret = fsctl_query_iface_info_ioctl(conn, rsp, out_buf_len);
+		if (ret < 0)
 			goto out;
+		nbytes = ret;
 		break;
 	case FSCTL_REQUEST_RESUME_KEY:
 		if (out_buf_len < sizeof(struct resume_key_ioctl_rsp)) {
-- 
2.32.0