diff options
| author | Konstantin Belousov <kib@FreeBSD.org> | 2012-02-21 01:05:12 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2012-02-21 01:05:12 +0000 |
| commit | 526d0bd547574b185147f03c13e2db7abe566a08 (patch) | |
| tree | d0d078391c4959fc08545db4ab619daadd9cf1d9 /sys/kern/subr_uio.c | |
| parent | 57a82ba4d95159d3623b0d401cfc3cc8f6357c28 (diff) | |
| download | src-526d0bd547574b185147f03c13e2db7abe566a08.tar.gz src-526d0bd547574b185147f03c13e2db7abe566a08.zip | |
Fix found places where uio_resid is truncated to int.
Add the sysctl debug.iosize_max_clamp, enabled by default. Setting the
sysctl to zero allows to perform the SSIZE_MAX-sized i/o requests from
the usermode.
Discussed with: bde, das (previous versions)
MFC after: 1 month
Notes
Notes:
svn path=/head/; revision=231949
Diffstat (limited to 'sys/kern/subr_uio.c')
| -rw-r--r-- | sys/kern/subr_uio.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/kern/subr_uio.c b/sys/kern/subr_uio.c index d49e3c3a2631..3c7688aaad86 100644 --- a/sys/kern/subr_uio.c +++ b/sys/kern/subr_uio.c @@ -171,7 +171,7 @@ uiomove_faultflag(void *cp, int n, struct uio *uio, int nofault) { struct thread *td; struct iovec *iov; - u_int cnt; + size_t cnt; int error, newflags, save; td = curthread; @@ -245,14 +245,14 @@ out: int uiomove_frombuf(void *buf, int buflen, struct uio *uio) { - unsigned int offset, n; + size_t offset, n; if (uio->uio_offset < 0 || uio->uio_resid < 0 || (offset = uio->uio_offset) != uio->uio_offset) return (EINVAL); if (buflen <= 0 || offset >= buflen) return (0); - if ((n = buflen - offset) > INT_MAX) + if ((n = buflen - offset) > IOSIZE_MAX) return (EINVAL); return (uiomove((char *)buf + offset, n, uio)); } @@ -479,7 +479,7 @@ copyinuio(const struct iovec *iovp, u_int iovcnt, struct uio **uiop) uio->uio_offset = -1; uio->uio_resid = 0; for (i = 0; i < iovcnt; i++) { - if (iov->iov_len > INT_MAX - uio->uio_resid) { + if (iov->iov_len > IOSIZE_MAX - uio->uio_resid) { free(uio, M_IOV); return (EINVAL); } |