Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1336733 > unrolled thread

[PATCH] rose: correct integer overflow check

Back to article view | Back to linux.kernel

Contents

  [PATCH] rose: correct integer overflow check Insu Yun <wuninsu@gmail.com> - 2016-02-17 21:30 +0100
    Re: [PATCH] rose: correct integer overflow check David Miller <davem@davemloft.net> - 2016-02-18 21:40 +0100
      Re: [PATCH] rose: correct integer overflow check Ralf Baechle <ralf@linux-mips.org> - 2016-02-19 01:00 +0100

#1336733 — [PATCH] rose: correct integer overflow check

Since rose_ndevs is signed integer type,
it can be overflowed when it is negative.

Signed-off-by: Insu Yun <wuninsu@gmail.com>
---
 net/rose/af_rose.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 129d357..4f37fae 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1514,7 +1514,8 @@ static int __init rose_proto_init(void)
 	int i;
 	int rc;
 
-	if (rose_ndevs > 0x7FFFFFFF/sizeof(struct net_device *)) {
+	if (rose_ndevs < 0 ||
+	    rose_ndevs > 0x7FFFFFFF / sizeof(struct net_device *)) {
 		printk(KERN_ERR "ROSE: rose_proto_init - rose_ndevs parameter to large\n");
 		rc = -EINVAL;
 		goto out;
-- 
1.9.1

[toc] | [next] | [standalone]

#1337724

From: Insu Yun <wuninsu@gmail.com>
Date: Wed, 17 Feb 2016 15:25:13 -0500

> Since rose_ndevs is signed integer type,
> it can be overflowed when it is negative.
> 
> Signed-off-by: Insu Yun <wuninsu@gmail.com>

That's not how the expression is evaluated.

Because of the types on the right hand side of the comparison
the expressions are all promoted to unsigned.

Did you look at the compiler's assembler output?  I did when
reviewing your patch.

[toc] | [prev] | [next] | [standalone]

#1337801

On Thu, Feb 18, 2016 at 04:03:16PM -0500, Insu Yun wrote:

> 
>     Because of the types on the right hand side of the comparison
>     the expressions are all promoted to unsigned.
> 
>     Did you look at the compiler's assembler output?  I did when
>     reviewing your patch.
> 
> 
> I checked the assembler output right now.
> You are right.
> I realized that right hand side becomes unsigned due to sizeof.
> I think this patch is wrong. 
> Thanks. 

On a different level, the current whole approach of ROSE to just generate
a fixed number of devices at initialization time of ROSE is if not wrong
then at least very archaic.  The default number is 10 devices and probably
of those 9 are unused on a typical setup - that is, if the module has
been loaded intentionally at all.

As a solution I've implemented a patch to support creating of ROSE
devices through netlink plus the necessary changes to iproute2 to go
along with that.

  Ralf

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web