Fix mix of int/long (and multiple conversion from/to) by using consequently size_t for i and max and ssize_t for len and adjust function signatures of hex32_arg(), count_trail_chars(), num_arg() and strn_len() accordingly.

Signed-off-by: Peter Seiderer ps.report@gmx.net --- Changes v5 -> v6 - adjust to dropped patch ''net: pktgen: use defines for the various dec/hex number parsing digits lengths' - add rev-by Simon Horman - fix line break (suggested by Simon Horman)

Changes v4 -> v5 - split up patchset into part i/ii (suggested by Simon Horman) - instead of align to most common pattern (int) adjust all usages to size_t for i and max and ssize_t for len and adjust function signatures of hex32_arg(), count_trail_chars(), num_arg() and strn_len() accordingly - respect reverse xmas tree order for local variable declarations (where possible without too much code churn) - update subject line and patch description - fix checkpatch warning '"foo * bar" should be "foo *bar"' for count_trail_chars() and strn_len()

Changes v3 -> v4 - new patch (factored out of patch 'net: pktgen: fix access outside of user given buffer in pktgen_if_write()') --- net/core/pktgen.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 55064713223e..cd6b6c0dc0dc 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -746,10 +746,11 @@ static int pktgen_if_show(struct seq_file *seq, void *v) }

-static int hex32_arg(const char __user *user_buffer, unsigned long maxlen, - __u32 *num) +static ssize_t hex32_arg(const char __user *user_buffer, size_t maxlen, + __u32 *num) { - int i = 0; + size_t i = 0; + *num = 0;

for (; i < maxlen; i++) { @@ -768,10 +769,9 @@ static int hex32_arg(const char __user *user_buffer, unsigned long maxlen, return i; }

-static int count_trail_chars(const char __user * user_buffer, - unsigned int maxlen) +static ssize_t count_trail_chars(const char __user *user_buffer, size_t maxlen) { - int i; + size_t i;

for (i = 0; i < maxlen; i++) { char c; @@ -793,10 +793,10 @@ static int count_trail_chars(const char __user * user_buffer, return i; }

-static long num_arg(const char __user *user_buffer, unsigned long maxlen, - unsigned long *num) +static ssize_t num_arg(const char __user *user_buffer, size_t maxlen, + unsigned long *num) { - int i; + size_t i; *num = 0;

for (i = 0; i < maxlen; i++) { @@ -812,9 +812,9 @@ static long num_arg(const char __user *user_buffer, unsigned long maxlen, return i; }

-static int strn_len(const char __user * user_buffer, unsigned int maxlen) +static ssize_t strn_len(const char __user *user_buffer, size_t maxlen) { - int i; + size_t i;

for (i = 0; i < maxlen; i++) { char c; @@ -844,9 +844,9 @@ static int strn_len(const char __user * user_buffer, unsigned int maxlen) static ssize_t get_imix_entries(const char __user *buffer, struct pktgen_dev *pkt_dev) { - const int max_digits = 10; - int i = 0; - long len; + const size_t max_digits = 10; + size_t i = 0; + ssize_t len; char c;

pkt_dev->n_imix_entries = 0; @@ -895,9 +895,9 @@ static ssize_t get_imix_entries(const char __user *buffer, static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) { unsigned int n = 0; + size_t i = 0; + ssize_t len; char c; - ssize_t i = 0; - int len;

pkt_dev->nr_labels = 0; do { @@ -956,7 +956,8 @@ static ssize_t pktgen_if_write(struct file *file, { struct seq_file *seq = file->private_data; struct pktgen_dev *pkt_dev = seq->private; - int i, max, len; + size_t i, max; + ssize_t len; char name[16], valstr[32]; unsigned long value = 0; char *pg_result = NULL; @@ -1883,7 +1884,8 @@ static ssize_t pktgen_thread_write(struct file *file, { struct seq_file *seq = file->private_data; struct pktgen_thread *t = seq->private; - int i, max, len, ret; + size_t i, max; + ssize_t len, ret; char name[40]; char *pg_result;

Remove some superfluous variable initializing before hex32_arg call (as the same init is done here already).

Signed-off-by: Peter Seiderer ps.report@gmx.net Reviewed-by: Simon Horman horms@kernel.org --- Changes v5 -> v6 - adjust to dropped patch ''net: pktgen: use defines for the various dec/hex number parsing digits lengths'

Changes v4 -> v5 - split up patchset into part i/ii (suggested by Simon Horman) - add rev-by Simon Horman

Changes v3 -> v4 - new patch (factored out of patch 'net: pktgen: fix access outside of user given buffer in pktgen_if_write()') --- net/core/pktgen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c index b97a94cb85ac..204f93de03aa 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -1787,7 +1787,7 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "tos")) { - __u32 tmp_value = 0; + __u32 tmp_value; len = hex32_arg(&user_buffer[i], 2, &tmp_value); if (len < 0) return len; @@ -1803,7 +1803,7 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "traffic_class")) { - __u32 tmp_value = 0; + __u32 tmp_value; len = hex32_arg(&user_buffer[i], 2, &tmp_value); if (len < 0) return len;

Honour the user given buffer size for the hex32_arg(), num_arg(), strn_len(), get_imix_entries() and get_labels() calls (otherwise they will access memory outside of the user given buffer).

Signed-off-by: Peter Seiderer ps.report@gmx.net Reviewed-by: Simon Horman horms@kernel.org --- Changes v5 -> v6 - adjust to dropped patch ''net: pktgen: use defines for the various dec/hex number parsing digits lengths'

Changes v4 -> v5 - split up patchset into part i/ii (suggested by Simon Horman) - add rev-by Simon Horman

Changes v3 -> v4: - replace C99 comment (suggested by Paolo Abeni) - drop available characters check in strn_len() (suggested by Paolo Abeni) - factored out patch 'net: pktgen: align some variable declarations to the most common pattern' (suggested by Paolo Abeni) - factored out patch 'net: pktgen: remove extra tmp variable (re-use len instead)' (suggested by Paolo Abeni) - factored out patch 'net: pktgen: remove some superfluous variable initializing' (suggested by Paolo Abeni) - factored out patch 'net: pktgen: fix mpls maximum labels list parsing' (suggested by Paolo Abeni) - factored out 'net: pktgen: hex32_arg/num_arg error out in case no characters are available' (suggested by Paolo Abeni) - factored out 'net: pktgen: num_arg error out in case no valid character is parsed' (suggested by Paolo Abeni)

Changes v2 -> v3: - no changes

Changes v1 -> v2: - additional fix get_imix_entries() and get_labels() --- net/core/pktgen.c | 178 ++++++++++++++++++++++++++++++---------------- 1 file changed, 118 insertions(+), 60 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 03ea6b5db156..ae5e81e62733 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -842,10 +842,10 @@ static ssize_t strn_len(const char __user *user_buffer, size_t maxlen) * "size1,weight_1 size2,weight_2 ... size_n,weight_n" for example. */ static ssize_t get_imix_entries(const char __user *buffer, + size_t maxlen, struct pktgen_dev *pkt_dev) { - const size_t max_digits = 10; - size_t i = 0; + size_t i = 0, max; ssize_t len; char c;

@@ -858,10 +858,13 @@ static ssize_t get_imix_entries(const char __user *buffer, if (pkt_dev->n_imix_entries >= MAX_IMIX_ENTRIES) return -E2BIG;

- len = num_arg(&buffer[i], max_digits, &size); + max = min(10, maxlen - i); + len = num_arg(&buffer[i], max, &size); if (len < 0) return len; i += len; + if (i >= maxlen) + return -EINVAL; if (get_user(c, &buffer[i])) return -EFAULT; /* Check for comma between size_i and weight_i */ @@ -872,7 +875,8 @@ static ssize_t get_imix_entries(const char __user *buffer, if (size < 14 + 20 + 8) size = 14 + 20 + 8;

- len = num_arg(&buffer[i], max_digits, &weight); + max = min(10, maxlen - i); + len = num_arg(&buffer[i], max, &weight); if (len < 0) return len; if (weight <= 0) @@ -882,20 +886,23 @@ static ssize_t get_imix_entries(const char __user *buffer, pkt_dev->imix_entries[pkt_dev->n_imix_entries].weight = weight;

i += len; + pkt_dev->n_imix_entries++; + + if (i >= maxlen) + break; if (get_user(c, &buffer[i])) return -EFAULT; - i++; - pkt_dev->n_imix_entries++; } while (c == ' ');

return i; }

-static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) +static ssize_t get_labels(const char __user *buffer, + size_t maxlen, struct pktgen_dev *pkt_dev) { unsigned int n = 0; - size_t i = 0; + size_t i = 0, max; ssize_t len; char c;

@@ -906,17 +913,20 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) if (n >= MAX_MPLS_LABELS) return -E2BIG;

- len = hex32_arg(&buffer[i], 8, &tmp); + max = min(8, maxlen - i); + len = hex32_arg(&buffer[i], max, &tmp); if (len <= 0) return len; pkt_dev->labels[n] = htonl(tmp); if (pkt_dev->labels[n] & MPLS_STACK_BOTTOM) pkt_dev->flags |= F_MPLS_RND; i += len; + n++; + if (i >= maxlen) + break; if (get_user(c, &buffer[i])) return -EFAULT; i++; - n++; } while (c == ',');

pkt_dev->nr_labels = n; @@ -981,8 +991,8 @@ static ssize_t pktgen_if_write(struct file *file, i = len;

/* Read variable name */ - - len = strn_len(&user_buffer[i], sizeof(name) - 1); + max = min(sizeof(name) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1010,7 +1020,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "min_pkt_size")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1027,7 +1038,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "max_pkt_size")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1046,7 +1058,8 @@ static ssize_t pktgen_if_write(struct file *file, /* Shortcut for min = max */

if (!strcmp(name, "pkt_size")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1066,7 +1079,8 @@ static ssize_t pktgen_if_write(struct file *file, if (pkt_dev->clone_skb > 0) return -EINVAL;

- len = get_imix_entries(&user_buffer[i], pkt_dev); + max = count - i; + len = get_imix_entries(&user_buffer[i], max, pkt_dev); if (len < 0) return len;

@@ -1077,7 +1091,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "debug")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1088,7 +1103,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "frags")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1098,7 +1114,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "delay")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1113,7 +1130,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "rate")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1128,7 +1146,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "ratep")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1143,7 +1162,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "udp_src_min")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1156,7 +1176,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "udp_dst_min")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1169,7 +1190,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "udp_src_max")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1182,7 +1204,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "udp_dst_max")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1195,7 +1218,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "clone_skb")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len; /* clone_skb is not supported for netif_receive xmit_mode and @@ -1216,7 +1240,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "count")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1227,7 +1252,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "src_mac_count")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1241,7 +1267,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst_mac_count")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1255,7 +1282,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "burst")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1274,7 +1302,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "node")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1295,11 +1324,12 @@ static ssize_t pktgen_if_write(struct file *file, if (!strcmp(name, "xmit_mode")) { char f[32];

- memset(f, 0, 32); - len = strn_len(&user_buffer[i], sizeof(f) - 1); + max = min(sizeof(f) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

+ memset(f, 0, sizeof(f)); if (copy_from_user(f, &user_buffer[i], len)) return -EFAULT; i += len; @@ -1335,11 +1365,12 @@ static ssize_t pktgen_if_write(struct file *file, char f[32]; char *end;

- memset(f, 0, 32); - len = strn_len(&user_buffer[i], sizeof(f) - 1); + max = min(sizeof(f) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

+ memset(f, 0, 32); if (copy_from_user(f, &user_buffer[i], len)) return -EFAULT; i += len; @@ -1384,7 +1415,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst_min") || !strcmp(name, "dst")) { - len = strn_len(&user_buffer[i], sizeof(pkt_dev->dst_min) - 1); + max = min(sizeof(pkt_dev->dst_min) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1404,7 +1436,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst_max")) { - len = strn_len(&user_buffer[i], sizeof(pkt_dev->dst_max) - 1); + max = min(sizeof(pkt_dev->dst_max) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1424,7 +1457,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst6")) { - len = strn_len(&user_buffer[i], sizeof(buf) - 1); + max = min(sizeof(buf) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1447,7 +1481,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst6_min")) { - len = strn_len(&user_buffer[i], sizeof(buf) - 1); + max = min(sizeof(buf) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1469,7 +1504,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst6_max")) { - len = strn_len(&user_buffer[i], sizeof(buf) - 1); + max = min(sizeof(buf) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1490,7 +1526,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "src6")) { - len = strn_len(&user_buffer[i], sizeof(buf) - 1); + max = min(sizeof(buf) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1513,7 +1550,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "src_min")) { - len = strn_len(&user_buffer[i], sizeof(pkt_dev->src_min) - 1); + max = min(sizeof(pkt_dev->src_min) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1533,7 +1571,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "src_max")) { - len = strn_len(&user_buffer[i], sizeof(pkt_dev->src_max) - 1); + max = min(sizeof(pkt_dev->src_max) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1553,7 +1592,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "dst_mac")) { - len = strn_len(&user_buffer[i], sizeof(valstr) - 1); + max = min(sizeof(valstr) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1570,7 +1610,8 @@ static ssize_t pktgen_if_write(struct file *file, return count; } if (!strcmp(name, "src_mac")) { - len = strn_len(&user_buffer[i], sizeof(valstr) - 1); + max = min(sizeof(valstr) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len;

@@ -1594,7 +1635,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "flows")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1608,7 +1650,8 @@ static ssize_t pktgen_if_write(struct file *file, } #ifdef CONFIG_XFRM if (!strcmp(name, "spi")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1619,7 +1662,8 @@ static ssize_t pktgen_if_write(struct file *file, } #endif if (!strcmp(name, "flowlen")) { - len = num_arg(&user_buffer[i], 10, &value); + max = min(10, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1630,7 +1674,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "queue_map_min")) { - len = num_arg(&user_buffer[i], 5, &value); + max = min(5, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1641,7 +1686,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "queue_map_max")) { - len = num_arg(&user_buffer[i], 5, &value); + max = min(5, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1654,7 +1700,8 @@ static ssize_t pktgen_if_write(struct file *file, if (!strcmp(name, "mpls")) { unsigned int n, cnt;

- len = get_labels(&user_buffer[i], pkt_dev); + max = count - i; + len = get_labels(&user_buffer[i], max, pkt_dev); if (len < 0) return len; i += len; @@ -1675,7 +1722,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "vlan_id")) { - len = num_arg(&user_buffer[i], 4, &value); + max = min(4, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1702,7 +1750,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "vlan_p")) { - len = num_arg(&user_buffer[i], 1, &value); + max = min(1, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1717,7 +1766,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "vlan_cfi")) { - len = num_arg(&user_buffer[i], 1, &value); + max = min(1, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1732,7 +1782,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "svlan_id")) { - len = num_arg(&user_buffer[i], 4, &value); + max = min(4, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1759,7 +1810,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "svlan_p")) { - len = num_arg(&user_buffer[i], 1, &value); + max = min(1, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1774,7 +1826,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "svlan_cfi")) { - len = num_arg(&user_buffer[i], 1, &value); + max = min(1, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

@@ -1790,7 +1843,9 @@ static ssize_t pktgen_if_write(struct file *file,

if (!strcmp(name, "tos")) { __u32 tmp_value; - len = hex32_arg(&user_buffer[i], 2, &tmp_value); + + max = min(2, count - i); + len = hex32_arg(&user_buffer[i], max, &tmp_value); if (len < 0) return len;

@@ -1806,7 +1861,9 @@ static ssize_t pktgen_if_write(struct file *file,

if (!strcmp(name, "traffic_class")) { __u32 tmp_value; - len = hex32_arg(&user_buffer[i], 2, &tmp_value); + + max = min(2, count - i); + len = hex32_arg(&user_buffer[i], max, &tmp_value); if (len < 0) return len;

@@ -1821,7 +1878,8 @@ static ssize_t pktgen_if_write(struct file *file, }

if (!strcmp(name, "skb_priority")) { - len = num_arg(&user_buffer[i], 9, &value); + max = min(9, count - i); + len = num_arg(&user_buffer[i], max, &value); if (len < 0) return len;

Remove all superfluous index ('i += len') assignements (value not used afterwards).

Signed-off-by: Peter Seiderer ps.report@gmx.net Reviewed-by: Simon Horman horms@kernel.org --- Changes v5 -> v6 - add rev-by Simon Horman

Changes v4 -> v5 - new patch (suggested by Simon Horman) --- net/core/pktgen.c | 52 ++++++----------------------------------------- 1 file changed, 6 insertions(+), 46 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c index bb13a4591709..96511e57c3fb 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -1030,7 +1030,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value < 14 + 20 + 8) value = 14 + 20 + 8; if (value != pkt_dev->min_pkt_size) { @@ -1048,7 +1047,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value < 14 + 20 + 8) value = 14 + 20 + 8; if (value != pkt_dev->max_pkt_size) { @@ -1068,7 +1066,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value < 14 + 20 + 8) value = 14 + 20 + 8; if (value != pkt_dev->min_pkt_size) { @@ -1091,7 +1088,6 @@ static ssize_t pktgen_if_write(struct file *file,

fill_imix_distribution(pkt_dev);

- i += len; return count; }

@@ -1101,7 +1097,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; debug = value; sprintf(pg_result, "OK: debug=%u", debug); return count; @@ -1113,7 +1108,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->nfrags = value; sprintf(pg_result, "OK: frags=%d", pkt_dev->nfrags); return count; @@ -1124,7 +1118,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value == 0x7FFFFFFF) pkt_dev->delay = ULLONG_MAX; else @@ -1140,7 +1133,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (!value) return -EINVAL; pkt_dev->delay = pkt_dev->min_pkt_size*8*NSEC_PER_USEC/value; @@ -1156,7 +1148,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (!value) return -EINVAL; pkt_dev->delay = NSEC_PER_SEC/value; @@ -1172,7 +1163,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value != pkt_dev->udp_src_min) { pkt_dev->udp_src_min = value; pkt_dev->cur_udp_src = value; @@ -1186,7 +1176,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value != pkt_dev->udp_dst_min) { pkt_dev->udp_dst_min = value; pkt_dev->cur_udp_dst = value; @@ -1200,7 +1189,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value != pkt_dev->udp_src_max) { pkt_dev->udp_src_max = value; pkt_dev->cur_udp_src = value; @@ -1214,7 +1202,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value != pkt_dev->udp_dst_max) { pkt_dev->udp_dst_max = value; pkt_dev->cur_udp_dst = value; @@ -1238,7 +1225,6 @@ static ssize_t pktgen_if_write(struct file *file, !(pkt_dev->flags & F_SHARED))) return -EINVAL;

- i += len; pkt_dev->clone_skb = value;

sprintf(pg_result, "OK: clone_skb=%d", pkt_dev->clone_skb); @@ -1250,7 +1236,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->count = value; sprintf(pg_result, "OK: count=%llu", (unsigned long long)pkt_dev->count); @@ -1262,7 +1247,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (pkt_dev->src_mac_count != value) { pkt_dev->src_mac_count = value; pkt_dev->cur_src_mac_offset = 0; @@ -1277,7 +1261,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (pkt_dev->dst_mac_count != value) { pkt_dev->dst_mac_count = value; pkt_dev->cur_dst_mac_offset = 0; @@ -1292,7 +1275,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value > 1) && ((pkt_dev->xmit_mode == M_QUEUE_XMIT) || ((pkt_dev->xmit_mode == M_START_XMIT) && @@ -1312,8 +1294,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; - if (node_possible(value)) { pkt_dev->node = value; sprintf(pg_result, "OK: node=%d", pkt_dev->node); @@ -1337,7 +1317,6 @@ static ssize_t pktgen_if_write(struct file *file, memset(f, 0, sizeof(f)); if (copy_from_user(f, &user_buffer[i], len)) return -EFAULT; - i += len;

if (strcmp(f, "start_xmit") == 0) { pkt_dev->xmit_mode = M_START_XMIT; @@ -1378,7 +1357,6 @@ static ssize_t pktgen_if_write(struct file *file, memset(f, 0, 32); if (copy_from_user(f, &user_buffer[i], len)) return -EFAULT; - i += len;

flag = pktgen_read_flag(f, &disable); if (flag) { @@ -1436,7 +1414,7 @@ static ssize_t pktgen_if_write(struct file *file, } if (debug) pr_debug("dst_min set to: %s\n", pkt_dev->dst_min); - i += len; + sprintf(pg_result, "OK: dst_min=%s", pkt_dev->dst_min); return count; } @@ -1457,7 +1435,7 @@ static ssize_t pktgen_if_write(struct file *file, } if (debug) pr_debug("dst_max set to: %s\n", pkt_dev->dst_max); - i += len; + sprintf(pg_result, "OK: dst_max=%s", pkt_dev->dst_max); return count; } @@ -1481,7 +1459,6 @@ static ssize_t pktgen_if_write(struct file *file, if (debug) pr_debug("dst6 set to: %s\n", buf);

- i += len; sprintf(pg_result, "OK: dst6=%s", buf); return count; } @@ -1504,7 +1481,6 @@ static ssize_t pktgen_if_write(struct file *file, if (debug) pr_debug("dst6_min set to: %s\n", buf);

- i += len; sprintf(pg_result, "OK: dst6_min=%s", buf); return count; } @@ -1526,7 +1502,6 @@ static ssize_t pktgen_if_write(struct file *file, if (debug) pr_debug("dst6_max set to: %s\n", buf);

- i += len; sprintf(pg_result, "OK: dst6_max=%s", buf); return count; } @@ -1550,7 +1525,6 @@ static ssize_t pktgen_if_write(struct file *file, if (debug) pr_debug("src6 set to: %s\n", buf);

- i += len; sprintf(pg_result, "OK: src6=%s", buf); return count; } @@ -1571,7 +1545,7 @@ static ssize_t pktgen_if_write(struct file *file, } if (debug) pr_debug("src_min set to: %s\n", pkt_dev->src_min); - i += len; + sprintf(pg_result, "OK: src_min=%s", pkt_dev->src_min); return count; } @@ -1592,7 +1566,7 @@ static ssize_t pktgen_if_write(struct file *file, } if (debug) pr_debug("src_max set to: %s\n", pkt_dev->src_max); - i += len; + sprintf(pg_result, "OK: src_max=%s", pkt_dev->src_max); return count; } @@ -1645,7 +1619,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value > MAX_CFLOWS) value = MAX_CFLOWS;

@@ -1660,7 +1633,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->spi = value; sprintf(pg_result, "OK: spi=%u", pkt_dev->spi); return count; @@ -1672,7 +1644,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->lflow = value; sprintf(pg_result, "OK: flowlen=%u", pkt_dev->lflow); return count; @@ -1684,7 +1655,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->queue_map_min = value; sprintf(pg_result, "OK: queue_map_min=%u", pkt_dev->queue_map_min); return count; @@ -1696,7 +1666,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->queue_map_max = value; sprintf(pg_result, "OK: queue_map_max=%u", pkt_dev->queue_map_max); return count; @@ -1709,7 +1678,7 @@ static ssize_t pktgen_if_write(struct file *file, len = get_labels(&user_buffer[i], max, pkt_dev); if (len < 0) return len; - i += len; + cnt = sprintf(pg_result, "OK: mpls="); for (n = 0; n < pkt_dev->nr_labels; n++) cnt += sprintf(pg_result + cnt, @@ -1732,7 +1701,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (value <= 4095) { pkt_dev->vlan_id = value; /* turn on VLAN */

@@ -1760,7 +1728,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value <= 7) && (pkt_dev->vlan_id != 0xffff)) { pkt_dev->vlan_p = value; sprintf(pg_result, "OK: vlan_p=%u", pkt_dev->vlan_p); @@ -1776,7 +1743,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value <= 1) && (pkt_dev->vlan_id != 0xffff)) { pkt_dev->vlan_cfi = value; sprintf(pg_result, "OK: vlan_cfi=%u", pkt_dev->vlan_cfi); @@ -1792,7 +1758,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value <= 4095) && ((pkt_dev->vlan_id != 0xffff))) { pkt_dev->svlan_id = value; /* turn on SVLAN */

@@ -1820,7 +1785,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value <= 7) && (pkt_dev->svlan_id != 0xffff)) { pkt_dev->svlan_p = value; sprintf(pg_result, "OK: svlan_p=%u", pkt_dev->svlan_p); @@ -1836,7 +1800,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if ((value <= 1) && (pkt_dev->svlan_id != 0xffff)) { pkt_dev->svlan_cfi = value; sprintf(pg_result, "OK: svlan_cfi=%u", pkt_dev->svlan_cfi); @@ -1854,7 +1817,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (len == 2) { pkt_dev->tos = tmp_value; sprintf(pg_result, "OK: tos=0x%02x", pkt_dev->tos); @@ -1872,7 +1834,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; if (len == 2) { pkt_dev->traffic_class = tmp_value; sprintf(pg_result, "OK: traffic_class=0x%02x", pkt_dev->traffic_class); @@ -1888,7 +1849,6 @@ static ssize_t pktgen_if_write(struct file *file, if (len < 0) return len;

- i += len; pkt_dev->skb_priority = value; sprintf(pg_result, "OK: skb_priority=%i", pkt_dev->skb_priority); @@ -2005,7 +1965,7 @@ static ssize_t pktgen_thread_write(struct file *file, } if (copy_from_user(f, &user_buffer[i], len)) return -EFAULT; - i += len; + mutex_lock(&pktgen_thread_lock); ret = pktgen_add_device(t, f); mutex_unlock(&pktgen_thread_lock);