Fix mix of int/long (and multiple conversion from/to) by using consequently size_t for i and max and ssize_t for len and adjust function signatures of hex32_arg(), count_trail_chars(), num_arg() and strn_len() accordingly.

Signed-off-by: Peter Seiderer ps.report@gmx.net Reviewed-by: Simon Horman horms@kernel.org --- Changes v7 -> v8 - rebased on actual net-next/main - add rev-by Simon Horman (this time for real)

Changes v6 -> v7 - rebased on actual net-next/main - no changes

Changes v5 -> v6 - adjust to dropped patch 'net: pktgen: use defines for the various dec/hex number parsing digits lengths' - add rev-by Simon Horman - fix line break (suggested by Simon Horman)

Changes v4 -> v5 - split up patchset into part i/ii (suggested by Simon Horman) - instead of align to most common pattern (int) adjust all usages to size_t for i and max and ssize_t for len and adjust function signatures of hex32_arg(), count_trail_chars(), num_arg() and strn_len() accordingly - respect reverse xmas tree order for local variable declarations (where possible without too much code churn) - update subject line and patch description - fix checkpatch warning '"foo * bar" should be "foo *bar"' for count_trail_chars() and strn_len()

Changes v3 -> v4 - new patch (factored out of patch 'net: pktgen: fix access outside of user given buffer in pktgen_if_write()') --- net/core/pktgen.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 402e01a2ce19..4775cdd2ae1c 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -744,10 +744,11 @@ static int pktgen_if_show(struct seq_file *seq, void *v) }

-static int hex32_arg(const char __user *user_buffer, unsigned long maxlen, - __u32 *num) +static ssize_t hex32_arg(const char __user *user_buffer, size_t maxlen, + __u32 *num) { - int i = 0; + size_t i = 0; + *num = 0;

for (; i < maxlen; i++) { @@ -766,10 +767,9 @@ static int hex32_arg(const char __user *user_buffer, unsigned long maxlen, return i; }

-static int count_trail_chars(const char __user * user_buffer, - unsigned int maxlen) +static ssize_t count_trail_chars(const char __user *user_buffer, size_t maxlen) { - int i; + size_t i;

for (i = 0; i < maxlen; i++) { char c; @@ -791,10 +791,10 @@ static int count_trail_chars(const char __user * user_buffer, return i; }

-static long num_arg(const char __user *user_buffer, unsigned long maxlen, - unsigned long *num) +static ssize_t num_arg(const char __user *user_buffer, size_t maxlen, + unsigned long *num) { - int i; + size_t i; *num = 0;

for (i = 0; i < maxlen; i++) { @@ -810,9 +810,9 @@ static long num_arg(const char __user *user_buffer, unsigned long maxlen, return i; }

-static int strn_len(const char __user * user_buffer, unsigned int maxlen) +static ssize_t strn_len(const char __user *user_buffer, size_t maxlen) { - int i; + size_t i;

for (i = 0; i < maxlen; i++) { char c; @@ -842,9 +842,9 @@ static int strn_len(const char __user * user_buffer, unsigned int maxlen) static ssize_t get_imix_entries(const char __user *buffer, struct pktgen_dev *pkt_dev) { - const int max_digits = 10; - int i = 0; - long len; + const size_t max_digits = 10; + size_t i = 0; + ssize_t len; char c;

pkt_dev->n_imix_entries = 0; @@ -893,9 +893,9 @@ static ssize_t get_imix_entries(const char __user *buffer, static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) { unsigned int n = 0; + size_t i = 0; + ssize_t len; char c; - ssize_t i = 0; - int len;

pkt_dev->nr_labels = 0; do { @@ -954,7 +954,8 @@ static ssize_t pktgen_if_write(struct file *file, { struct seq_file *seq = file->private_data; struct pktgen_dev *pkt_dev = seq->private; - int i, max, len; + size_t i, max; + ssize_t len; char name[16], valstr[32]; unsigned long value = 0; char *pg_result = NULL; @@ -1881,7 +1882,8 @@ static ssize_t pktgen_thread_write(struct file *file, { struct seq_file *seq = file->private_data; struct pktgen_thread *t = seq->private; - int i, max, len, ret; + size_t i, max; + ssize_t len, ret; char name[40]; char *pg_result;

Remove some superfluous variable initializing before hex32_arg call (as the same init is done here already).

Signed-off-by: Peter Seiderer ps.report@gmx.net Reviewed-by: Simon Horman horms@kernel.org --- Changes v7 -> v8 - rebased on actual net-next/main - no changes

Changes v6 -> v7 - rebased on actual net-next/main - no changes

Changes v5 -> v6 - adjust to dropped patch 'net: pktgen: use defines for the various dec/hex number parsing digits lengths'

Changes v4 -> v5 - split up patchset into part i/ii (suggested by Simon Horman) - add rev-by Simon Horman

Changes v3 -> v4 - new patch (factored out of patch 'net: pktgen: fix access outside of user given buffer in pktgen_if_write()') --- net/core/pktgen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 9a5fc1298bd3..b678b28dedae 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -1785,7 +1785,7 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "tos")) { - __u32 tmp_value = 0; + __u32 tmp_value; len = hex32_arg(&user_buffer[i], 2, &tmp_value); if (len < 0) return len; @@ -1801,7 +1801,7 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "traffic_class")) { - __u32 tmp_value = 0; + __u32 tmp_value; len = hex32_arg(&user_buffer[i], 2, &tmp_value); if (len < 0) return len;

Honour the user given buffer size for the hex32_arg(), num_arg(), strn_len(), get_imix_entries() and get_labels() calls (otherwise they will access memory outside of the user given buffer).

Signed-off-by: Peter Seiderer ps.report@gmx.net Reviewed-by: Simon Horman horms@kernel.org --- Changes v7 -> v8 - rebased on actual net-next/main - no changes

Changes v6 -> v7 - rebased on actual net-next/main - no changes

Changes v5 -> v6 - adjust to dropped patch 'net: pktgen: use defines for the various dec/hex number parsing digits lengths'

Changes v4 -> v5 - split up patchset into part i/ii (suggested by Simon Horman) - add rev-by Simon Horman

Changes v3 -> v4: - replace C99 comment (suggested by Paolo Abeni) - drop available characters check in strn_len() (suggested by Paolo Abeni) - factored out patch 'net: pktgen: align some variable declarations to the most common pattern' (suggested by Paolo Abeni) - factored out patch 'net: pktgen: remove extra tmp variable (re-use len instead)' (suggested by Paolo Abeni) - factored out patch 'net: pktgen: remove some superfluous variable initializing' (suggested by Paolo Abeni) - factored out patch 'net: pktgen: fix mpls maximum labels list parsing' (suggested by Paolo Abeni) - factored out 'net: pktgen: hex32_arg/num_arg error out in case no characters are available' (suggested by Paolo Abeni) - factored out 'net: pktgen: num_arg error out in case no valid character is parsed' (suggested by Paolo Abeni)

Changes v2 -> v3: - no changes

Changes v1 -> v2: - additional fix get_imix_entries() and get_labels() --- net/core/pktgen.c | 178 ++++++++++++++++++++++++++++++---------------- 1 file changed, 118 insertions(+), 60 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c index def35a734d9d..f4f9c9d83694 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -840,10 +840,10 @@ static ssize_t strn_len(const char __user *user_buffer, size_t maxlen) * "size1,weight_1 size2,weight_2 ... size_n,weight_n" for example. */ static ssize_t get_imix_entries(const char __user *buffer, + size_t maxlen, struct pktgen_dev *pkt_dev) { - const size_t max_digits = 10; - size_t i = 0; + size_t i = 0, max; ssize_t len; char c;

@@ -856,10 +856,13 @@ static ssize_t get_imix_entries(const char __user *buffer, if (pkt_dev->n_imix_entries >= MAX_IMIX_ENTRIES) return -E2BIG;

- len = num_arg(&buffer[i], max_digits, &size); + max = min(10, maxlen - i); + len = num_arg(&buffer[i], max, &size); if (len < 0) return len; i += len; + if (i >= maxlen) + return -EINVAL; if (get_user(c, &buffer[i])) return -EFAULT; /* Check for comma between size_i and weight_i */ @@ -870,7 +873,8 @@ static ssize_t get_imix_entries(const char __user *buffer, if (size < 14 + 20 + 8) size = 14 + 20 + 8;

- len = num_arg(&buffer[i], max_digits, &weight); + max = min(10, maxlen - i); + len = num_arg(&buffer[i], max, &weight); if (len < 0) return len; if (weight <= 0) @@ -880,20 +884,23 @@ static ssize_t get_imix_entries(const char __user *buffer, pkt_dev->imix_entries[pkt_dev->n_imix_entries].weight = weight;

i += len; + pkt_dev->n_imix_entries++; + + if (i >= maxlen) + break; if (get_user(c, &buffer[i])) return -EFAULT; - i++; - pkt_dev->n_imix_entries++; } while (c == ' ');

return i; }

-static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) +static ssize_t get_labels(const char __user *buffer, + size_t maxlen, struct pktgen_dev *pkt_dev) { unsigned int n = 0; - size_t i = 0; + size_t i = 0, max; ssize_t len; char c;

@@ -904,17 +911,20 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) if (n >= MAX_MPLS_LABELS) return -E2BIG;

- len = hex32_arg(&buffer[i], 8, &tmp); + max = min(8, maxlen - i); + len = hex32_arg(&buffer[i], max, &tmp); if (len <= 0) return len; pkt_dev->labels[n] = htonl(tmp); if (pkt_dev->labels[n] & MPLS_STACK_BOTTOM) pkt_dev->flags |= F_MPLS_RND; i += len; + n++; + if (i >= maxlen) + break; if (get_user(c, &buffer[i])) return -EFAULT; i++; - n++; } while (c == ',');

pkt_dev->nr_labels = n; @@ -979,8 +989,8 @@ static ssize_t pktgen_if_write(struct file *file, i = len;

/* Read variable name */ - - len = strn_len(&user_buffer[i], sizeof(name) - 1); + max = min(sizeof(name) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1008,7 +1018,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "min_pkt_size")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1025,7 +1036,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "max_pkt_size")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1044,7 +1056,8 @@ static ssize_t pktgen_if_write(struct file *file, /* Shortcut for min = max */

if (!strcmp(name, "pkt_size")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1064,7 +1077,8 @@ static ssize_t pktgen_if_write(struct file *file, if (pkt_dev->clone_skb > 0) return -EINVAL;

- len = get_imix_entries(&user_buffer[i], pkt_dev); + max = count - i; + len = get_imix_entries(&user_buffer[i], max, pkt_dev); if (len < 0) return len;

@@ -1075,7 +1089,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "debug")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1086,7 +1101,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "frags")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1096,7 +1112,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "delay")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1111,7 +1128,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "rate")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1126,7 +1144,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "ratep")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1141,7 +1160,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "udp_src_min")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1154,7 +1174,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "udp_dst_min")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1167,7 +1188,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "udp_src_max")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1180,7 +1202,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "udp_dst_max")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1193,7 +1216,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "clone_skb")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len; /* clone_skb is not supported for netif_receive xmit_mode and @@ -1214,7 +1238,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "count")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1225,7 +1250,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "src_mac_count")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1239,7 +1265,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst_mac_count")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1253,7 +1280,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "burst")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1272,7 +1300,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "node")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1293,11 +1322,12 @@ static ssize_t pktgen_if_write(struct file *file, if (!strcmp(name, "xmit_mode")) { char f[32];

- memset(f, 0, 32); - len = strn_len(&user_buffer[i], sizeof(f) - 1); + max = min(sizeof(f) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

+ memset(f, 0, sizeof(f)); if (copy_from_user(f, &user_buffer[i], len)) return -EFAULT; i += len; @@ -1333,11 +1363,12 @@ static ssize_t pktgen_if_write(struct file *file, char f[32]; char *end;

- memset(f, 0, 32); - len = strn_len(&user_buffer[i], sizeof(f) - 1); + max = min(sizeof(f) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

+ memset(f, 0, 32); if (copy_from_user(f, &user_buffer[i], len)) return -EFAULT; i += len; @@ -1382,7 +1413,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst_min") || !strcmp(name, "dst")) { - len = strn_len(&user_buffer[i], sizeof(pkt_dev->dst_min) - 1); + max = min(sizeof(pkt_dev->dst_min) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1402,7 +1434,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst_max")) { - len = strn_len(&user_buffer[i], sizeof(pkt_dev->dst_max) - 1); + max = min(sizeof(pkt_dev->dst_max) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1422,7 +1455,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst6")) { - len = strn_len(&user_buffer[i], sizeof(buf) - 1); + max = min(sizeof(buf) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1445,7 +1479,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst6_min")) { - len = strn_len(&user_buffer[i], sizeof(buf) - 1); + max = min(sizeof(buf) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1467,7 +1502,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst6_max")) { - len = strn_len(&user_buffer[i], sizeof(buf) - 1); + max = min(sizeof(buf) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1488,7 +1524,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "src6")) { - len = strn_len(&user_buffer[i], sizeof(buf) - 1); + max = min(sizeof(buf) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1511,7 +1548,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "src_min")) { - len = strn_len(&user_buffer[i], sizeof(pkt_dev->src_min) - 1); + max = min(sizeof(pkt_dev->src_min) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1531,7 +1569,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "src_max")) { - len = strn_len(&user_buffer[i], sizeof(pkt_dev->src_max) - 1); + max = min(sizeof(pkt_dev->src_max) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1551,7 +1590,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst_mac")) { - len = strn_len(&user_buffer[i], sizeof(valstr) - 1); + max = min(sizeof(valstr) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1568,7 +1608,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "src_mac")) { - len = strn_len(&user_buffer[i], sizeof(valstr) - 1); + max = min(sizeof(valstr) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1592,7 +1633,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "flows")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1606,7 +1648,8 @@ static ssize_t pktgen_if_write(struct file *file, } #ifdef CONFIG_XFRM if (!strcmp(name, "spi")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1617,7 +1660,8 @@ static ssize_t pktgen_if_write(struct file *file, } #endif if (!strcmp(name, "flowlen")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1628,7 +1672,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "queue_map_min")) { - len = num_arg(&user_buffer[i], 5, &value); + max = min(5, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1639,7 +1684,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "queue_map_max")) { - len = num_arg(&user_buffer[i], 5, &value); + max = min(5, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1652,7 +1698,8 @@ static ssize_t pktgen_if_write(struct file *file, if (!strcmp(name, "mpls")) { unsigned int n, cnt;

- len = get_labels(&user_buffer[i], pkt_dev); + max = count - i; + len = get_labels(&user_buffer[i], max, pkt_dev); if (len < 0) return len; i += len; @@ -1673,7 +1720,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "vlan_id")) { - len = num_arg(&user_buffer[i], 4, &value); + max = min(4, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1700,7 +1748,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "vlan_p")) { - len = num_arg(&user_buffer[i], 1, &value); + max = min(1, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1715,7 +1764,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "vlan_cfi")) { - len = num_arg(&user_buffer[i], 1, &value); + max = min(1, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1730,7 +1780,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "svlan_id")) { - len = num_arg(&user_buffer[i], 4, &value); + max = min(4, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1757,7 +1808,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "svlan_p")) { - len = num_arg(&user_buffer[i], 1, &value); + max = min(1, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1772,7 +1824,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "svlan_cfi")) { - len = num_arg(&user_buffer[i], 1, &value); + max = min(1, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1788,7 +1841,9 @@ static ssize_t pktgen_if_write(struct file *file,

if (!strcmp(name, "tos")) { __u32 tmp_value; - len = hex32_arg(&user_buffer[i], 2, &tmp_value); + + max = min(2, count - i); + len = hex32_arg(&user_buffer[i], max, &tmp_value); if (len < 0) return len;

@@ -1804,7 +1859,9 @@ static ssize_t pktgen_if_write(struct file *file,

if (!strcmp(name, "traffic_class")) { __u32 tmp_value; - len = hex32_arg(&user_buffer[i], 2, &tmp_value); + + max = min(2, count - i); + len = hex32_arg(&user_buffer[i], max, &tmp_value); if (len < 0) return len;

@@ -1819,7 +1876,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "skb_priority")) { - len = num_arg(&user_buffer[i], 9, &value); + max = min(9, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

Remove all superfluous index ('i += len') assignements (value not used afterwards).

Signed-off-by: Peter Seiderer ps.report@gmx.net Reviewed-by: Simon Horman horms@kernel.org --- Changes v7 -> v8 - rebased on actual net-next/main - no changes

Changes v6 -> v7 - rebased on actual net-next/main - no changes

Changes v5 -> v6 - add rev-by Simon Horman

Changes v4 -> v5 - new patch (suggested by Simon Horman) --- net/core/pktgen.c | 52 ++++++----------------------------------------- 1 file changed, 6 insertions(+), 46 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c index c604a68f2840..e850598db3e7 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -1028,7 +1028,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value < 14 + 20 + 8) value = 14 + 20 + 8; if (value != pkt_dev->min_pkt_size) { @@ -1046,7 +1045,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value < 14 + 20 + 8) value = 14 + 20 + 8; if (value != pkt_dev->max_pkt_size) { @@ -1066,7 +1064,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value < 14 + 20 + 8) value = 14 + 20 + 8; if (value != pkt_dev->min_pkt_size) { @@ -1089,7 +1086,6 @@ static ssize_t pktgen_if_write(struct file *file,

fill_imix_distribution(pkt_dev);

- i += len; return count; }

@@ -1099,7 +1095,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; debug = value; sprintf(pg_result, "OK: debug=%u", debug); return count; @@ -1111,7 +1106,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->nfrags = value; sprintf(pg_result, "OK: frags=%d", pkt_dev->nfrags); return count; @@ -1122,7 +1116,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value == 0x7FFFFFFF) pkt_dev->delay = ULLONG_MAX; else @@ -1138,7 +1131,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (!value) return -EINVAL; pkt_dev->delay = pkt_dev->min_pkt_size*8*NSEC_PER_USEC/value; @@ -1154,7 +1146,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (!value) return -EINVAL; pkt_dev->delay = NSEC_PER_SEC/value; @@ -1170,7 +1161,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value != pkt_dev->udp_src_min) { pkt_dev->udp_src_min = value; pkt_dev->cur_udp_src = value; @@ -1184,7 +1174,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value != pkt_dev->udp_dst_min) { pkt_dev->udp_dst_min = value; pkt_dev->cur_udp_dst = value; @@ -1198,7 +1187,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value != pkt_dev->udp_src_max) { pkt_dev->udp_src_max = value; pkt_dev->cur_udp_src = value; @@ -1212,7 +1200,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value != pkt_dev->udp_dst_max) { pkt_dev->udp_dst_max = value; pkt_dev->cur_udp_dst = value; @@ -1236,7 +1223,6 @@ static ssize_t pktgen_if_write(struct file *file, !(pkt_dev->flags & F_SHARED))) return -EINVAL;

- i += len; pkt_dev->clone_skb = value;

sprintf(pg_result, "OK: clone_skb=%d", pkt_dev->clone_skb); @@ -1248,7 +1234,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->count = value; sprintf(pg_result, "OK: count=%llu", (unsigned long long)pkt_dev->count); @@ -1260,7 +1245,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (pkt_dev->src_mac_count != value) { pkt_dev->src_mac_count = value; pkt_dev->cur_src_mac_offset = 0; @@ -1275,7 +1259,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (pkt_dev->dst_mac_count != value) { pkt_dev->dst_mac_count = value; pkt_dev->cur_dst_mac_offset = 0; @@ -1290,7 +1273,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value > 1) && ((pkt_dev->xmit_mode == M_QUEUE_XMIT) || ((pkt_dev->xmit_mode == M_START_XMIT) && @@ -1310,8 +1292,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; - if (node_possible(value)) { pkt_dev->node = value; sprintf(pg_result, "OK: node=%d", pkt_dev->node); @@ -1335,7 +1315,6 @@ static ssize_t pktgen_if_write(struct file *file, memset(f, 0, sizeof(f)); if (copy_from_user(f, &user_buffer[i], len)) return -EFAULT; - i += len;

if (strcmp(f, "start_xmit") == 0) { pkt_dev->xmit_mode = M_START_XMIT; @@ -1376,7 +1355,6 @@ static ssize_t pktgen_if_write(struct file *file, memset(f, 0, 32); if (copy_from_user(f, &user_buffer[i], len)) return -EFAULT; - i += len;

flag = pktgen_read_flag(f, &disable); if (flag) { @@ -1434,7 +1412,7 @@ static ssize_t pktgen_if_write(struct file *file, } if (debug) pr_debug("dst_min set to: %s\n", pkt_dev->dst_min); - i += len; + sprintf(pg_result, "OK: dst_min=%s", pkt_dev->dst_min); return count; } @@ -1455,7 +1433,7 @@ static ssize_t pktgen_if_write(struct file *file, } if (debug) pr_debug("dst_max set to: %s\n", pkt_dev->dst_max); - i += len; + sprintf(pg_result, "OK: dst_max=%s", pkt_dev->dst_max); return count; } @@ -1479,7 +1457,6 @@ static ssize_t pktgen_if_write(struct file *file, if (debug) pr_debug("dst6 set to: %s\n", buf);

- i += len; sprintf(pg_result, "OK: dst6=%s", buf); return count; } @@ -1502,7 +1479,6 @@ static ssize_t pktgen_if_write(struct file *file, if (debug) pr_debug("dst6_min set to: %s\n", buf);

- i += len; sprintf(pg_result, "OK: dst6_min=%s", buf); return count; } @@ -1524,7 +1500,6 @@ static ssize_t pktgen_if_write(struct file *file, if (debug) pr_debug("dst6_max set to: %s\n", buf);

- i += len; sprintf(pg_result, "OK: dst6_max=%s", buf); return count; } @@ -1548,7 +1523,6 @@ static ssize_t pktgen_if_write(struct file *file, if (debug) pr_debug("src6 set to: %s\n", buf);

- i += len; sprintf(pg_result, "OK: src6=%s", buf); return count; } @@ -1569,7 +1543,7 @@ static ssize_t pktgen_if_write(struct file *file, } if (debug) pr_debug("src_min set to: %s\n", pkt_dev->src_min); - i += len; + sprintf(pg_result, "OK: src_min=%s", pkt_dev->src_min); return count; } @@ -1590,7 +1564,7 @@ static ssize_t pktgen_if_write(struct file *file, } if (debug) pr_debug("src_max set to: %s\n", pkt_dev->src_max); - i += len; + sprintf(pg_result, "OK: src_max=%s", pkt_dev->src_max); return count; } @@ -1643,7 +1617,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value > MAX_CFLOWS) value = MAX_CFLOWS;

@@ -1658,7 +1631,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->spi = value; sprintf(pg_result, "OK: spi=%u", pkt_dev->spi); return count; @@ -1670,7 +1642,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->lflow = value; sprintf(pg_result, "OK: flowlen=%u", pkt_dev->lflow); return count; @@ -1682,7 +1653,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->queue_map_min = value; sprintf(pg_result, "OK: queue_map_min=%u", pkt_dev->queue_map_min); return count; @@ -1694,7 +1664,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->queue_map_max = value; sprintf(pg_result, "OK: queue_map_max=%u", pkt_dev->queue_map_max); return count; @@ -1707,7 +1676,7 @@ static ssize_t pktgen_if_write(struct file *file, len = get_labels(&user_buffer[i], max, pkt_dev); if (len < 0) return len; - i += len; + cnt = sprintf(pg_result, "OK: mpls="); for (n = 0; n < pkt_dev->nr_labels; n++) cnt += sprintf(pg_result + cnt, @@ -1730,7 +1699,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value <= 4095) { pkt_dev->vlan_id = value; /* turn on VLAN */

@@ -1758,7 +1726,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value <= 7) && (pkt_dev->vlan_id != 0xffff)) { pkt_dev->vlan_p = value; sprintf(pg_result, "OK: vlan_p=%u", pkt_dev->vlan_p); @@ -1774,7 +1741,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value <= 1) && (pkt_dev->vlan_id != 0xffff)) { pkt_dev->vlan_cfi = value; sprintf(pg_result, "OK: vlan_cfi=%u", pkt_dev->vlan_cfi); @@ -1790,7 +1756,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value <= 4095) && ((pkt_dev->vlan_id != 0xffff))) { pkt_dev->svlan_id = value; /* turn on SVLAN */

@@ -1818,7 +1783,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value <= 7) && (pkt_dev->svlan_id != 0xffff)) { pkt_dev->svlan_p = value; sprintf(pg_result, "OK: svlan_p=%u", pkt_dev->svlan_p); @@ -1834,7 +1798,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value <= 1) && (pkt_dev->svlan_id != 0xffff)) { pkt_dev->svlan_cfi = value; sprintf(pg_result, "OK: svlan_cfi=%u", pkt_dev->svlan_cfi); @@ -1852,7 +1815,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (len == 2) { pkt_dev->tos = tmp_value; sprintf(pg_result, "OK: tos=0x%02x", pkt_dev->tos); @@ -1870,7 +1832,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (len == 2) { pkt_dev->traffic_class = tmp_value; sprintf(pg_result, "OK: traffic_class=0x%02x", pkt_dev->traffic_class); @@ -1886,7 +1847,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->skb_priority = value; sprintf(pg_result, "OK: skb_priority=%i", pkt_dev->skb_priority); @@ -2003,7 +1963,7 @@ static ssize_t pktgen_thread_write(struct file *file, } if (copy_from_user(f, &user_buffer[i], len)) return -EFAULT; - i += len; + mutex_lock(&pktgen_thread_lock); ret = pktgen_add_device(t, f); mutex_unlock(&pktgen_thread_lock);