From patchwork Wed Mar 29 14:11:21 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Konovalov X-Patchwork-Id: 744813 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3vtV7j3q6pz9s2P for ; Thu, 30 Mar 2017 01:12:01 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="QsiAzfYg"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932679AbdC2OLt (ORCPT ); Wed, 29 Mar 2017 10:11:49 -0400 Received: from mail-wr0-f181.google.com ([209.85.128.181]:33359 "EHLO mail-wr0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752907AbdC2OLi (ORCPT ); Wed, 29 Mar 2017 10:11:38 -0400 Received: by mail-wr0-f181.google.com with SMTP id w43so17223649wrb.0 for ; Wed, 29 Mar 2017 07:11:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=dSRc2rtE4Kkw16PSFNmmwat1RJZDVJo/pAmt8TANfjQ=; b=QsiAzfYgu6GJ4lL9raD+Jj/7+GusIs/cyz7FhmeCj+F85NEXVYt1+ZY4cTo7M4Jrd/ zM1U0SE9o+KH4eYmZdAYjmLczjS4cR95p3ooB/herXXK6jOt0iLB1b4aiWDpDSMkMtAp Qo3UliIOlR54+cEAOjsXjoGedmHNrsUReh8TGdsvLOjiBwe56lwXBJl/E8FxPE61kUFB s8rUNF+H6GVm3zChNuNzryIzaIe24dsGuDL8rLf4ZMc8pMGKFuNH7+tKXIkercLwWPXc AL4GhtZTUjIm3l0t58VVEYy8YWAF6LRriaBTM09JhGrgeRtGQsqEpNxhwEGoIHcYRXWh 4vug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=dSRc2rtE4Kkw16PSFNmmwat1RJZDVJo/pAmt8TANfjQ=; b=eQmAC5I6GLfwjLjyra/v72HWv75qEcSbQqnryhaKXH4ztJFLXORdz5ARhwRX/GrpXz 0K1EDyF9iCVmGneqyVRLeSci7u2wUYXrfH1SC/W/EeMnyEccJV43ejfiHfs3v7lUYKZ0 jwcrtMoTdeAPPslCtmNkZGb2O4/jRzeImnK1xNSWMQL9s5WbGyceeO8MI5FZdCmof3wO HLZkjskFik1QYXXspJA2piVIQky9Eq1B0g5h74oAXELZiKNyajMCErTv3pf9kvVvzBDs 9JGwCyPbWtXhuO9xTLNWddh9h8nYlqSHaoMF4q/VmXJHZqkz8lLwmIjP+iwoJ46/DOdt k39A== X-Gm-Message-State: AFeK/H3/akbjBx5kzMEXd1qTA9A4arweRUB+JIpl4sbUdymGtJkp/vyH/DcD6uKrU2gceM1G X-Received: by 10.28.31.139 with SMTP id f133mr1583959wmf.25.1490796696277; Wed, 29 Mar 2017 07:11:36 -0700 (PDT) Received: from andreyknvl0.muc.corp.google.com ([100.105.12.17]) by smtp.gmail.com with ESMTPSA id h76sm8320463wmd.33.2017.03.29.07.11.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Mar 2017 07:11:35 -0700 (PDT) Received: by andreyknvl0.muc.corp.google.com (Postfix, from userid 206546) id BBB5218097A; Wed, 29 Mar 2017 16:11:34 +0200 (CEST) From: Andrey Konovalov To: "David S . Miller" , Eric Dumazet , Willem de Bruijn , Craig Gallek Cc: netdev@vger.kernel.org, Dmitry Vyukov , Kostya Serebryany , Andrey Konovalov Subject: [PATCH net v2 2/3] net/packet: fix overflow in check for tp_frame_nr Date: Wed, 29 Mar 2017 16:11:21 +0200 Message-Id: X-Mailer: git-send-email 2.12.2.564.g063fe858b8-goog In-Reply-To: References: In-Reply-To: References: Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When calculating rb->frames_per_block * req->tp_block_nr the result can overflow. Add a check that tp_block_size * tp_block_nr <= UINT_MAX. Since frames_per_block <= tp_block_size, the expression would never overflow. Signed-off-by: Andrey Konovalov Acked-by: Eric Dumazet --- net/packet/af_packet.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 2323ee35dc09..3ac286ebb2f4 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4205,6 +4205,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, rb->frames_per_block = req->tp_block_size / req->tp_frame_size; if (unlikely(rb->frames_per_block == 0)) goto out; + if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr)) + goto out; if (unlikely((rb->frames_per_block * req->tp_block_nr) != req->tp_frame_nr)) goto out;