Patchwork net/llc: make opt unsigned in llc_ui_setsockopt()

login
register
mail settings
Submitter Dan Carpenter
Date Sept. 10, 2010, 11:56 a.m.
Message ID <20100910115616.GD5959@bicker>
Download mbox | patch
Permalink /patch/64384/
State Accepted
Delegated to: David Miller
Headers show

Comments

Dan Carpenter - Sept. 10, 2010, 11:56 a.m.
The members of struct llc_sock are unsigned so if we pass a negative
value for "opt" it can cause a sign bug.  Also it can cause an integer
overflow when we multiply "opt * HZ".

CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller - Sept. 13, 2010, 7:45 p.m.
From: Dan Carpenter <error27@gmail.com>
Date: Fri, 10 Sep 2010 13:56:16 +0200

> The members of struct llc_sock are unsigned so if we pass a negative
> value for "opt" it can cause a sign bug.  Also it can cause an integer
> overflow when we multiply "opt * HZ".
> 
> CC: stable@kernel.org
> Signed-off-by: Dan Carpenter <error27@gmail.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 023ba82..5826129 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -1024,7 +1024,8 @@  static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
 {
 	struct sock *sk = sock->sk;
 	struct llc_sock *llc = llc_sk(sk);
-	int rc = -EINVAL, opt;
+	unsigned int opt;
+	int rc = -EINVAL;
 
 	lock_sock(sk);
 	if (unlikely(level != SOL_LLC || optlen != sizeof(int)))