Author: tuexen
Date: Sun Mar 24 10:40:20 2019
New Revision: 345466
URL: https://svnweb.freebsd.org/changeset/base/345466
Log:
Fox more signed unsigned issues. This time on the send path.
This is joint work with rrs@ and was found by running syzkaller.
MFC after: 1 week
Modified:
head/sys/netinet/sctp_output.c
head/sys/netinet/sctp_structs.h
Modified: head/sys/netinet/sctp_output.c
==============================================================================
--- head/sys/netinet/sctp_output.c Sun Mar 24 09:46:16 2019
(r345465)
+++ head/sys/netinet/sctp_output.c Sun Mar 24 10:40:20 2019
(r345466)
@@ -6889,7 +6889,7 @@ sctp_sendall(struct sctp_inpcb *inp, struct uio *uio,
ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL;
/* get length and mbuf chain */
if (uio) {
- ca->sndlen = (int)uio->uio_resid;
+ ca->sndlen = uio->uio_resid;
ca->m = sctp_copy_out_all(uio, ca->sndlen);
if (ca->m == NULL) {
SCTP_FREE(ca, SCTP_M_COPYAL);
@@ -12533,7 +12533,7 @@ sctp_lower_sosend(struct socket *so,
struct thread *p
)
{
- unsigned int sndlen = 0, max_len;
+ size_t sndlen = 0, max_len;
int error, len;
struct mbuf *top = NULL;
int queue_only = 0, queue_only_for_init = 0;
@@ -12585,12 +12585,12 @@ sctp_lower_sosend(struct socket *so,
SCTP_LTRACE_ERR_RET(inp, stcb, net,
SCTP_FROM_SCTP_OUTPUT, EINVAL);
return (EINVAL);
}
- sndlen = (unsigned int)uio->uio_resid;
+ sndlen = uio->uio_resid;
} else {
top = SCTP_HEADER_TO_CHAIN(i_pak);
sndlen = SCTP_HEADER_LEN(i_pak);
}
- SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %d\n",
+ SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %zu\n",
(void *)addr,
sndlen);
if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
@@ -12944,7 +12944,7 @@ sctp_lower_sosend(struct socket *so,
/* Are we aborting? */
if (srcv->sinfo_flags & SCTP_ABORT) {
struct mbuf *mm;
- int tot_demand, tot_out = 0, max_out;
+ size_t tot_demand, tot_out = 0, max_out;
SCTP_STAT_INCR(sctps_sends_with_abort);
if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
@@ -13000,7 +13000,7 @@ sctp_lower_sosend(struct socket *so,
ph++;
SCTP_BUF_LEN(mm) = tot_out + sizeof(struct
sctp_paramhdr);
if (top == NULL) {
- error = uiomove((caddr_t)ph, (int)tot_out, uio);
+ error = uiomove((caddr_t)ph, tot_out, uio);
if (error) {
/*-
* Here if we can't get his data we
@@ -13229,7 +13229,7 @@ skip_preblock:
if ((max_len >
SCTP_BASE_SYSCTL(sctp_add_more_threshold)) ||
(max_len && (SCTP_SB_LIMIT_SND(so) <
SCTP_BASE_SYSCTL(sctp_add_more_threshold))) ||
- (uio->uio_resid && (uio->uio_resid <=
(int)max_len))) {
+ (uio->uio_resid && (uio->uio_resid <= max_len))) {
sndout = 0;
new_tail = NULL;
if (hold_tcblock) {
Modified: head/sys/netinet/sctp_structs.h
==============================================================================
--- head/sys/netinet/sctp_structs.h Sun Mar 24 09:46:16 2019
(r345465)
+++ head/sys/netinet/sctp_structs.h Sun Mar 24 10:40:20 2019
(r345466)
@@ -166,7 +166,7 @@ struct sctp_copy_all {
struct sctp_inpcb *inp; /* ep */
struct mbuf *m;
struct sctp_sndrcvinfo sndrcv;
- int sndlen;
+ size_t sndlen;
int cnt_sent;
int cnt_failed;
};
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
