Whoops, got 3 independent patches for this and overlooked this one. See
https://lore.kernel.org/linux-nfs/20201106205959.gb26...@fieldses.org/T/#t
--b.
On Sat, Oct 24, 2020 at 03:52:40PM +0100, Alex Dewar wrote:
> Commit c09f56b8f68d ("net/sunrpc: Fix return value for sysctl
> sunrpc.transports") attempted to add error checking for the call to
> memory_read_from_buffer(), however its return value was assigned to a
> size_t variable, so any negative values would be lost in the cast. Fix
> this.
>
> Addresses-Coverity-ID: 1498033: Control flow issues (NO_EFFECT)
> Fixes: c09f56b8f68d ("net/sunrpc: Fix return value for sysctl
> sunrpc.transports")
> Signed-off-by: Alex Dewar <alex.dewa...@gmail.com>
> ---
> net/sunrpc/sysctl.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
> index a18b36b5422d..c95a2b84dd95 100644
> --- a/net/sunrpc/sysctl.c
> +++ b/net/sunrpc/sysctl.c
> @@ -62,6 +62,7 @@ rpc_unregister_sysctl(void)
> static int proc_do_xprt(struct ctl_table *table, int write,
> void *buffer, size_t *lenp, loff_t *ppos)
> {
> + ssize_t bytes_read;
> char tmpbuf[256];
> size_t len;
>
> @@ -70,12 +71,14 @@ static int proc_do_xprt(struct ctl_table *table, int
> write,
> return 0;
> }
> len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
> - *lenp = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
> + bytes_read = memory_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
>
> - if (*lenp < 0) {
> + if (bytes_read < 0) {
> *lenp = 0;
> return -EINVAL;
> }
> +
> + *lenp = bytes_read;
> return 0;
> }
>
> --
> 2.29.1
