Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba1cffe0 authored by Xi Wang's avatar Xi Wang Committed by David S. Miller
Browse files

ax25: avoid overflows in ax25_setsockopt() 



Commit be639ac6 ("NET: AX.25: Check ioctl arguments to avoid overflows
further down the road") rejects very large arguments, but doesn't
completely fix overflows on 64-bit systems.  Consider the AX25_T2 case.

	int opt;
	...
	if (opt < 1 || opt > ULONG_MAX / HZ) {
		res = -EINVAL;
		break;
	}
	ax25->t2 = opt * HZ;

The 32-bit multiplication opt * HZ would overflow before being assigned
to 64-bit ax25->t2.  This patch changes "opt" to unsigned long.

Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fa843095

net/ax25/af_ax25.c

+6 −5
Original line number Diff line number Diff line
@@ -545,15 +545,16 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, 
	ax25_cb *ax25;

	struct net_device *dev;

	char devname[IFNAMSIZ];

	int opt, res = 0;

	unsigned long opt;

	int res = 0;



	if (level != SOL_AX25)

		return -ENOPROTOOPT;



	if (optlen < sizeof(int))

	if (optlen < sizeof(unsigned int))

		return -EINVAL;



	if (get_user(opt, (int __user *)optval))

	if (get_user(opt, (unsigned int __user *)optval))

		return -EFAULT;



	lock_sock(sk);
@@ -609,7 +610,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case AX25_IDLE:

		if (opt < 0 || opt > ULONG_MAX / (60 * HZ)) {

		if (opt > ULONG_MAX / (60 * HZ)) {

			res = -EINVAL;

			break;

		}
@@ -617,7 +618,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, 
		break;



	case AX25_BACKOFF:

		if (opt < 0 || opt > 2) {

		if (opt > 2) {

			res = -EINVAL;

			break;

		}