Path: csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod From: Greg Kroah-Hartman Newsgroups: linux.kernel Subject: [PATCH 4.10 12/62] net/packet: fix overflow in check for tp_frame_nr Date: Mon, 01 May 2017 23:40:03 +0200 Message-ID: References: X-Original-To: linux-kernel@vger.kernel.org X-Mailer: git-send-email 2.12.2 User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: robomod@news.nic.it List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Approved: robomod@news.nic.it Lines: 36 Organization: linux.* mail to news gateway X-Original-Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrey Konovalov , Eric Dumazet , "David S. Miller" X-Original-Date: Mon, 1 May 2017 14:34:25 -0700 X-Original-Message-ID: <20170501212731.260444878@linuxfoundation.org> X-Original-References: <20170501212730.774855694@linuxfoundation.org> X-Original-Sender: linux-kernel-owner@vger.kernel.org Xref: csiph.com linux.kernel:1633900 4.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andrey Konovalov [ Upstream commit 8f8d28e4d6d815a391285e121c3a53a0b6cb9e7b ] When calculating rb->frames_per_block * req->tp_block_nr the result can overflow. Add a check that tp_block_size * tp_block_nr <= UINT_MAX. Since frames_per_block <= tp_block_size, the expression would never overflow. Signed-off-by: Andrey Konovalov Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/packet/af_packet.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4189,6 +4189,8 @@ static int packet_set_ring(struct sock * rb->frames_per_block = req->tp_block_size / req->tp_frame_size; if (unlikely(rb->frames_per_block == 0)) goto out; + if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr)) + goto out; if (unlikely((rb->frames_per_block * req->tp_block_nr) != req->tp_frame_nr)) goto out;