From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752118AbbKJWPF (ORCPT ); Tue, 10 Nov 2015 17:15:05 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:17802 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751519AbbKJWPE (ORCPT ); Tue, 10 Nov 2015 17:15:04 -0500 Date: Wed, 11 Nov 2015 01:14:41 +0300 From: Dan Carpenter To: Petr Vandrovec Cc: David Howells , Jan Kara , Al Viro , Andrew Morton , linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch v2] ncpfs: don't allow negative timeouts Message-ID: <20151110221441.GA30281@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151110091923.GE26699@quack.suse.cz> User-Agent: Mutt/1.5.23 (2014-03-12) X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This code causes a static checker warning because it's a user controlled variable where we cap the upper bound but not the lower bound. Let's return an -EINVAL for negative timeouts. Signed-off-by: Dan Carpenter --- v2: in the original I just ignored the invalid data and went with the default but now it returns -EINVAL. diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c index 79b1130..ebf45d2 100644 --- a/fs/ncpfs/ioctl.c +++ b/fs/ncpfs/ioctl.c @@ -525,7 +525,9 @@ static long __ncp_ioctl(struct inode *inode, unsigned int cmd, unsigned long arg switch (rqdata.cmd) { case NCP_LOCK_EX: case NCP_LOCK_SH: - if (rqdata.timeout == 0) + if (rqdata.timeout < 0) + return -EINVAL; + else if (rqdata.timeout == 0) rqdata.timeout = NCP_LOCK_DEFAULT_TIMEOUT; else if (rqdata.timeout > NCP_LOCK_MAX_TIMEOUT) rqdata.timeout = NCP_LOCK_MAX_TIMEOUT; From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Tue, 10 Nov 2015 22:14:41 +0000 Subject: [patch v2] ncpfs: don't allow negative timeouts Message-Id: <20151110221441.GA30281@mwanda> List-Id: In-Reply-To: <20151110091923.GE26699@quack.suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Petr Vandrovec Cc: David Howells , Jan Kara , Al Viro , Andrew Morton , linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org This code causes a static checker warning because it's a user controlled variable where we cap the upper bound but not the lower bound. Let's return an -EINVAL for negative timeouts. Signed-off-by: Dan Carpenter --- v2: in the original I just ignored the invalid data and went with the default but now it returns -EINVAL. diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c index 79b1130..ebf45d2 100644 --- a/fs/ncpfs/ioctl.c +++ b/fs/ncpfs/ioctl.c @@ -525,7 +525,9 @@ static long __ncp_ioctl(struct inode *inode, unsigned int cmd, unsigned long arg switch (rqdata.cmd) { case NCP_LOCK_EX: case NCP_LOCK_SH: - if (rqdata.timeout = 0) + if (rqdata.timeout < 0) + return -EINVAL; + else if (rqdata.timeout = 0) rqdata.timeout = NCP_LOCK_DEFAULT_TIMEOUT; else if (rqdata.timeout > NCP_LOCK_MAX_TIMEOUT) rqdata.timeout = NCP_LOCK_MAX_TIMEOUT;