On Sat, 23 Sep 2017, Ingo Molnar wrote:
> static inline int
> __copy_xstate_to_kernel(void *kbuf,
> const void *data,
> - unsigned int pos, unsigned int count, int end_pos)
> + unsigned int offset, unsigned int size, int size_total)
Why is size_total int?
> {
> - if (!count)
> + if (!size)
> return 0;
>
> - if (end_pos < 0 || pos < end_pos) {
> - unsigned int copy = end_pos < 0 ? count : min(count, end_pos -
> pos);
> + if (size_total < 0 || offset < size_total) {
And why would it be < 0? The call sites of this inline are all inside of:
int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave,
unsigned int offset_start, int size_total)
and hand in size_total completely unmodified. copy_xstate_to_kernel()
itself has a single callsite:
int xstateregs_get(struct task_struct *target, const struct user_regset *regset,
unsigned int pos, unsigned int count,
void *kbuf, void __user *ubuf)
and that hands in count unmodified.
The same issue is with the to_user() variant which is even more
obvious. All callers are inside of copy_xstate_to_user() where size_total
is an unsigned int argument which is handed in unmodified.
This signed/unsigned mismatch is confusing at best.
Thanks,
tglx
