From patchwork Tue Mar 28 14:00:46 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Konovalov X-Patchwork-Id: 744302 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3vssyb3pzHz9s7K for ; Wed, 29 Mar 2017 01:01:59 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="Go0TFs+w"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755427AbdC1OBj (ORCPT ); Tue, 28 Mar 2017 10:01:39 -0400 Received: from mail-wr0-f179.google.com ([209.85.128.179]:36002 "EHLO mail-wr0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754155AbdC1OBg (ORCPT ); Tue, 28 Mar 2017 10:01:36 -0400 Received: by mail-wr0-f179.google.com with SMTP id w11so88287388wrc.3 for ; Tue, 28 Mar 2017 07:01:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=ycQtVXARhMlnunV3D9v99ANU06d+uPKqOP9PE5Fftk8=; b=Go0TFs+wZnmNCGHi+gIeyUMNG2QJh7znhy13qQNRiRH2eiCaO0DKWUoIyfiAhui1vF o7P/Z0rIK07l63yiZ134uIocGqW6QpRgJppoGRx2Q4GbgW8nNj2QM4szh8eLvJjCZ86H Sc5uXCNnsJThXLVHZhHRSvlvT22h7OVPBXUYg4pzKE5LI5xrdoZoLm54uthB4XzXptKQ FNG7zDBoG5C592eVH3PhU7zzn/5dSp9OfBcyye/lTrzoyhfyME9Xivdn+FazkBfTU4Ar JUk6+xJLnEbb40FhpZPeDIFe7lztdP5/C0kIQDWb65myoQIbaNscCdnSXaItIXR47KW0 bgmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=ycQtVXARhMlnunV3D9v99ANU06d+uPKqOP9PE5Fftk8=; b=mOi8mhY7/g7gE2gbcYqqA97kluX0CbgDO428DjN8k67BN2G6uyRnUF34pi+xVwB1xu StAWmsUeitD5sR08+CDfSpl/Ur4uLpBFy9Fd5LynV+8ec3oZFbSYUb6Gjjr7ZLx2oRuJ rRvqI9ASkrdg5XVfP/q25xGfRa3s30eRpYwAQbSoyErWCtu+y3QDcluPNxRCNkYv/4uS hRYFNAWPNe5Qhs0qKK2hSimk1lexbMnKdtbqJBgMypGxFR0nw6EUQ1IZg5HP6HWh1QFh L1O7gLSKJXy2to0XOkdyzF4/KeL+1Rkp5CmS3gqh6la6sNPTunT7LsbvEB3E+7UBiGUy cgdg== X-Gm-Message-State: AFeK/H3FBcC/x4e6Sx3euVSKDFEf34COQNPaPOkEL3km/3CdQLURBVFt023MfvKJO2QwgKj7 X-Received: by 10.223.151.198 with SMTP id t6mr26084705wrb.9.1490709663844; Tue, 28 Mar 2017 07:01:03 -0700 (PDT) Received: from andreyknvl0.muc.corp.google.com ([100.105.12.17]) by smtp.gmail.com with ESMTPSA id x133sm3752880wme.22.2017.03.28.07.00.59 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Mar 2017 07:01:00 -0700 (PDT) Received: by andreyknvl0.muc.corp.google.com (Postfix, from userid 206546) id 465CC182D46; Tue, 28 Mar 2017 16:00:56 +0200 (CEST) From: Andrey Konovalov To: "David S . Miller" , Eric Dumazet , Willem de Bruijn , Craig Gallek Cc: netdev@vger.kernel.org, Dmitry Vyukov , Kostya Serebryany , Andrey Konovalov Subject: [PATCH 3/5] net/packet: fix overflow in check for tp_frame_nr Date: Tue, 28 Mar 2017 16:00:46 +0200 Message-Id: <69c847e0cfbf26c38d6dfa6289ce5ca830866b42.1490709552.git.andreyknvl@google.com> X-Mailer: git-send-email 2.12.2.564.g063fe858b8-goog In-Reply-To: References: In-Reply-To: References: Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When calculating rb->frames_per_block * req->tp_block_nr the result can overflow. Add a check that tp_block_size * tp_block_nr <= UINT_MAX. Since frames_per_block <= tp_block_size, the expression would never overflow. Signed-off-by: Andrey Konovalov --- net/packet/af_packet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 506348abdf2f..c5c43fff8c01 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4197,6 +4197,9 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, goto out; if (unlikely(req->tp_frame_size == 0)) goto out; + if (unlikely((u64)req->tp_block_size * req->tp_block_nr > + UINT_MAX)) + goto out; if (unlikely(!PAGE_ALIGNED(req->tp_block_size))) goto out;