From patchwork Sat Feb 9 20:37:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kal Conley X-Patchwork-Id: 1039291 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=dectris.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=dectris.com header.i=@dectris.com header.b="sJ1P0I7Y"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 43xkQP214Sz9sMr for ; Sun, 10 Feb 2019 07:38:05 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727014AbfBIUh7 (ORCPT ); Sat, 9 Feb 2019 15:37:59 -0500 Received: from mail-ed1-f68.google.com ([209.85.208.68]:40356 "EHLO mail-ed1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726873AbfBIUh6 (ORCPT ); Sat, 9 Feb 2019 15:37:58 -0500 Received: by mail-ed1-f68.google.com with SMTP id g22so5613168edr.7 for ; Sat, 09 Feb 2019 12:37:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dectris.com; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=APhSD+PqtpJXFHU2VJSOwBXtyiRVtTxs2XUJJDme/Hk=; b=sJ1P0I7YQAF8pYjJnTlLRcTh5LD8Doezxdki5oV6mCueZmSDyQRln9CHl6jkFzmZyq jl69nySEhKJ2x3mPwDcOQeGyOTp5PaOSzq7YDuVVRbNp7dmNUs1S0VQb0mF4be9WSw7u s89NQfswNjmIWHm/RRDt9JYtQ/QTToqFcp6do= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=APhSD+PqtpJXFHU2VJSOwBXtyiRVtTxs2XUJJDme/Hk=; b=pG9/PgumXily3sOID86KM2tDj5PRYafwFvOZrLK0fIU2tqKKoyL1bE4k8deFiQOTMj HP3Rw2PVTq8nlzNWLl92NfPMstOmXUM1uV/kaYTZWtGwf9RbNN7EydoLsnTqmQ5tDv2o Er0qmjvwo96EKWjN3EH6IuNY0fT4LH/H354qUr1xd1SBKTV42uaqmLs4LYJXPwaPrFJg AzfzEY5xjyIj3YMlfoHX5Ff7hLr24O9IBw8fP70mMJ0jYW8hl0LIjOqaX5/tCV5SY+94 m9oM9hEabg0g0DcqWiGUw4Lv20jZpNjTiJYPHZKpiTjcZbhVacf0RcMRifz9wCig3HnI /yeA== X-Gm-Message-State: AHQUAuYYmdiA053GWtVTZHviuJ2uKmCeT4HCJ966QJXhnvnUy2vkSwCR TwFE8rhCIoy2oIVDM6fS1wF3yw== X-Google-Smtp-Source: AHgI3IafXDKlBCMZAouLkoZlckigjHIEySXlUOX93PZXUj60RelWkx/poQX2bs8NTW6gz5scNd+WaQ== X-Received: by 2002:a17:906:228f:: with SMTP id p15mr15030240eja.104.1549744676878; Sat, 09 Feb 2019 12:37:56 -0800 (PST) Received: from th2-ws216-fed.dectris.local ([2a02:aa10:b57e:8400:c727:f827:3beb:2ecc]) by smtp.googlemail.com with ESMTPSA id q50sm1653652edd.66.2019.02.09.12.37.55 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sat, 09 Feb 2019 12:37:56 -0800 (PST) From: Kal Conley To: davem@davemloft.net Cc: kal.conley@dectris.com, Willem de Bruijn , Eric Dumazet , Greg Kroah-Hartman , Jeff Kirsher , Alexander Duyck , Kirill Tkhai , Vincent Whitchurch , Li RongQing , Magnus Karlsson , netdev@vger.kernel.org (open list:NETWORKING [GENERAL]), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] net/packet: fix 4gb buffer limit due to overflow check Date: Sat, 9 Feb 2019 21:37:00 +0100 Message-Id: <20190209203701.27252-1-kal.conley@dectris.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When calculating rb->frames_per_block * req->tp_block_nr the result can overflow. Check it for overflow without limiting the total buffer size to UINT_MAX. This change fixes support for packet ring buffers >= UINT_MAX. --- net/packet/af_packet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index d0945253f43b..d603a430378e 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4291,7 +4291,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, rb->frames_per_block = req->tp_block_size / req->tp_frame_size; if (unlikely(rb->frames_per_block == 0)) goto out; - if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr)) + if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr)) goto out; if (unlikely((rb->frames_per_block * req->tp_block_nr) != req->tp_frame_nr))