io_uring: fix types in io_recvmsg_multishot_overflow
authorDylan Yudaken <dylany@fb.com>
Fri, 15 Jul 2022 13:02:52 +0000 (06:02 -0700)
committerJens Axboe <axboe@kernel.dk>
Mon, 25 Jul 2022 00:39:18 +0000 (18:39 -0600)
io_recvmsg_multishot_overflow had incorrect types on non x64 system.
But also it had an unnecessary INT_MAX check, which could just be done
by changing the type of the accumulator to int (also simplifying the
casts).

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Fixes: a8b38c4ce724 ("io_uring: support multishot in recvmsg")
Signed-off-by: Dylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220715130252.610639-1-dylany@fb.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
io_uring/net.c

index 616d5f04cc7435eaf151e6ee48d81ad04c93f995..6b7d5f33e642a0db90a75f892e1a7de3530b0542 100644 (file)
@@ -327,14 +327,14 @@ int io_send(struct io_kiocb *req, unsigned int issue_flags)
 
 static bool io_recvmsg_multishot_overflow(struct io_async_msghdr *iomsg)
 {
-       unsigned long hdr;
+       int hdr;
 
-       if (check_add_overflow(sizeof(struct io_uring_recvmsg_out),
-                              (unsigned long)iomsg->namelen, &hdr))
+       if (iomsg->namelen < 0)
                return true;
-       if (check_add_overflow(hdr, iomsg->controllen, &hdr))
+       if (check_add_overflow((int)sizeof(struct io_uring_recvmsg_out),
+                              iomsg->namelen, &hdr))
                return true;
-       if (hdr > INT_MAX)
+       if (check_add_overflow(hdr, (int)iomsg->controllen, &hdr))
                return true;
 
        return false;