svn commit: r347675 - stable/11/sys/netinet
Michael Tuexen
tuexen at FreeBSD.org
Thu May 16 09:24:12 UTC 2019
Author: tuexen
Date: Thu May 16 09:24:11 2019
New Revision: 347675
URL: https://svnweb.freebsd.org/changeset/base/347675
Log:
MFC r345466:
Fix more signed unsigned issues. This time on the send path.
This is joint work with rrs@ and was found by running syzkaller.
Modified:
stable/11/sys/netinet/sctp_output.c
stable/11/sys/netinet/sctp_structs.h
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/netinet/sctp_output.c
==============================================================================
--- stable/11/sys/netinet/sctp_output.c Thu May 16 09:22:37 2019 (r347674)
+++ stable/11/sys/netinet/sctp_output.c Thu May 16 09:24:11 2019 (r347675)
@@ -6883,7 +6883,7 @@ sctp_sendall(struct sctp_inpcb *inp, struct uio *uio,
ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL;
/* get length and mbuf chain */
if (uio) {
- ca->sndlen = (int)uio->uio_resid;
+ ca->sndlen = uio->uio_resid;
ca->m = sctp_copy_out_all(uio, ca->sndlen);
if (ca->m == NULL) {
SCTP_FREE(ca, SCTP_M_COPYAL);
@@ -12525,7 +12525,7 @@ sctp_lower_sosend(struct socket *so,
struct thread *p
)
{
- unsigned int sndlen = 0, max_len;
+ size_t sndlen = 0, max_len;
int error, len;
struct mbuf *top = NULL;
int queue_only = 0, queue_only_for_init = 0;
@@ -12577,12 +12577,12 @@ sctp_lower_sosend(struct socket *so,
SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
return (EINVAL);
}
- sndlen = (unsigned int)uio->uio_resid;
+ sndlen = uio->uio_resid;
} else {
top = SCTP_HEADER_TO_CHAIN(i_pak);
sndlen = SCTP_HEADER_LEN(i_pak);
}
- SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %d\n",
+ SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %zu\n",
(void *)addr,
sndlen);
if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
@@ -12934,7 +12934,7 @@ sctp_lower_sosend(struct socket *so,
/* Are we aborting? */
if (srcv->sinfo_flags & SCTP_ABORT) {
struct mbuf *mm;
- int tot_demand, tot_out = 0, max_out;
+ size_t tot_demand, tot_out = 0, max_out;
SCTP_STAT_INCR(sctps_sends_with_abort);
if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
@@ -12990,7 +12990,7 @@ sctp_lower_sosend(struct socket *so,
ph++;
SCTP_BUF_LEN(mm) = tot_out + sizeof(struct sctp_paramhdr);
if (top == NULL) {
- error = uiomove((caddr_t)ph, (int)tot_out, uio);
+ error = uiomove((caddr_t)ph, tot_out, uio);
if (error) {
/*-
* Here if we can't get his data we
@@ -13219,7 +13219,7 @@ skip_preblock:
if ((max_len > SCTP_BASE_SYSCTL(sctp_add_more_threshold)) ||
(max_len && (SCTP_SB_LIMIT_SND(so) < SCTP_BASE_SYSCTL(sctp_add_more_threshold))) ||
- (uio->uio_resid && (uio->uio_resid <= (int)max_len))) {
+ (uio->uio_resid && (uio->uio_resid <= max_len))) {
sndout = 0;
new_tail = NULL;
if (hold_tcblock) {
Modified: stable/11/sys/netinet/sctp_structs.h
==============================================================================
--- stable/11/sys/netinet/sctp_structs.h Thu May 16 09:22:37 2019 (r347674)
+++ stable/11/sys/netinet/sctp_structs.h Thu May 16 09:24:11 2019 (r347675)
@@ -164,7 +164,7 @@ struct sctp_copy_all {
struct sctp_inpcb *inp; /* ep */
struct mbuf *m;
struct sctp_sndrcvinfo sndrcv;
- int sndlen;
+ size_t sndlen;
int cnt_sent;
int cnt_failed;
};
More information about the svn-src-stable
mailing list