diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-09-18 15:42:25 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-09-19 20:59:43 +0200 |
| commit | 9b9d2e00bfa592aceda7b43da76c670df61faa97 (patch) | |
| tree | 8412e35fd4e379c4075e09a8f23c245663f91e59 | |
| parent | bna: off by one (diff) | |
| download | linux-9b9d2e00bfa592aceda7b43da76c670df61faa97.tar.xz linux-9b9d2e00bfa592aceda7b43da76c670df61faa97.zip | |
rds: signedness bug
In the original code if the copy_from_user() fails in rds_rdma_pages()
then the error handling fails and we get a stack trace from kmalloc().
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/rds/rdma.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/rds/rdma.c b/net/rds/rdma.c index 48064673fc76..1a41debca1ce 100644 --- a/net/rds/rdma.c +++ b/net/rds/rdma.c @@ -522,7 +522,7 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm, struct rds_rdma_args *args; struct rds_iovec vec; struct rm_rdma_op *op = &rm->rdma; - unsigned int nr_pages; + int nr_pages; unsigned int nr_bytes; struct page **pages = NULL; struct rds_iovec __user *local_vec; |