| Submitter | Dan Carpenter |
|---|---|
| Date | Sept. 10, 2010, 11:56 a.m. |
| Message ID | <20100910115616.GD5959@bicker> |
| Download | mbox | patch |
| Permalink | /patch/64384/ |
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
Comments
From: Dan Carpenter <error27@gmail.com> Date: Fri, 10 Sep 2010 13:56:16 +0200 > The members of struct llc_sock are unsigned so if we pass a negative > value for "opt" it can cause a sign bug. Also it can cause an integer > overflow when we multiply "opt * HZ". > > CC: stable@kernel.org > Signed-off-by: Dan Carpenter <error27@gmail.com> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Patch
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index 023ba82..5826129 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -1024,7 +1024,8 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname, { struct sock *sk = sock->sk; struct llc_sock *llc = llc_sk(sk); - int rc = -EINVAL, opt; + unsigned int opt; + int rc = -EINVAL; lock_sock(sk); if (unlikely(level != SOL_LLC || optlen != sizeof(int)))
The members of struct llc_sock are unsigned so if we pass a negative value for "opt" it can cause a sign bug. Also it can cause an integer overflow when we multiply "opt * HZ". CC: stable@kernel.org Signed-off-by: Dan Carpenter <error27@gmail.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html