On Thu, Aug 22, 2024 at 09:39:06PM +0800, Li Zetao wrote:
> When coping sockaddr in ip6_mc_msfget(), the time of copies
> depends on the minimum value between sl_count and gf_numsrc.
> Using min() here is very semantic.
>
> Signed-off-by: Li Zetao <lizetao1@xxxxxxxxxx>
> ---
> net/ipv6/mcast.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
> index 7ba01d8cfbae..b244dbf61d5f 100644
> --- a/net/ipv6/mcast.c
> +++ b/net/ipv6/mcast.c
> @@ -586,7 +586,8 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
> const struct in6_addr *group;
> struct ipv6_mc_socklist *pmc;
> struct ip6_sf_socklist *psl;
> - int i, count, copycount;
> + unsigned int count;
> + int i, copycount;
>
> group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
>
> @@ -610,7 +611,7 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
> psl = sock_dereference(pmc->sflist, sk);
> count = psl ? psl->sl_count : 0;
Both count and psl->sl_count are unsigned int,
so this looks safe (and more correct than what it replaces, IMHO).
>
> - copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
> + copycount = min(count, gsf->gf_numsrc);
And gsf->gf_numsrc is a __u32, so min operating on it and
count looks safe to me.
Further, the code it replaces seems to be a max() operation in
both intent and function.
Reviewed-by: Simon Horman <horms@xxxxxxxxxx>
> gsf->gf_numsrc = count;
> for (i = 0; i < copycount; i++) {
> struct sockaddr_in6 *psin6;
> --
> 2.34.1
>
>
