Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1624202

[PATCH 4.9 25/31] net/packet: fix overflow in check for priv area size

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrey Konovalov <andreyknvl@google.com>

commit 2b6867c2ce76c596676bec7d2d525af525fdc6e2 upstream.

Subtracting tp_sizeof_priv from tp_block_size and casting to int
to check whether one is less then the other doesn't always work
(both of them are unsigned ints).

Compare them as is instead.

Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as
it can overflow inside BLK_PLUS_PRIV otherwise.

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/packet/af_packet.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4235,8 +4235,8 @@ static int packet_set_ring(struct sock *
 		if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
 			goto out;
 		if (po->tp_version >= TPACKET_V3 &&
-		    (int)(req->tp_block_size -
-			  BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
+		    req->tp_block_size <=
+			  BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
 			goto out;
 		if (unlikely(req->tp_frame_size < po->tp_hdrlen +
 					po->tp_reserve))

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.9 00/31] 4.9.23-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:10 +0200
  [PATCH 4.9 10/31] orangefs: fix buffer size mis-match between kernel space and user space. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:10 +0200
  [PATCH 4.9 19/31] MIPS: Switch to the irq_stack in interrupts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:10 +0200
  [PATCH 4.9 06/31] drm/i915: Stop using RP_DOWN_EI on Baytrail Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:10 +0200
  [PATCH 4.9 17/31] MIPS: Stack unwinding while on IRQ stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:10 +0200
  [PATCH 4.9 13/31] rt2x00usb: do not anchor rx and tx urbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:10 +0200
  [PATCH 4.9 29/31] net/mlx4_core: Fix racy CQ (Completion Queue) free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 21/31] MIPS: IRQ Stack: Fix erroneous jal to plat_irq_dispatch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 28/31] net/mlx4_en: Fix bad WQE issue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 25/31] net/packet: fix overflow in check for priv area size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 20/31] MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 07/31] drm/i915: Avoid rcu_barrier() from reclaim paths (shrinker) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 18/31] MIPS: Only change $28 to thread_info if coming from user mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 08/31] orangefs: fix memory leak of string new on exit path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 12/31] rt2x00usb: fix anchor initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 16/31] MIPS: Introduce irq_stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 05/31] drm/i915: Drop support for I915_EXEC_CONSTANTS_* execbuf parameters. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 09/31] orangefs: Dan Carpenter influenced cleanups... Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 26/31] blk-mq: Avoid memory reclaim when remapping queues Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 10:20 +0200
  [PATCH 4.9 24/31] [PATCH] Revert "drm/i915/execlists: Reset RING registers upon resume" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
  Re: [PATCH 4.9 00/31] 4.9.23-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-16 23:30 +0200
  Re: [PATCH 4.9 00/31] 4.9.23-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-17 20:30 +0200

csiph-web