Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 32288eb4d940b10e40c6d4178fe3a40d1437d2f8

Authored by Xi Wang
Committed by David S. Miller
1 parent ba1cffe025
Exists in master and in 6 other branches imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

netrom: avoid overflows in nr_setsockopt() 

Check setsockopt arguments to avoid overflows and return -EINVAL for
too large arguments.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 7 additions and 7 deletions Side-by-side Diff

net/netrom/af_netrom.c
Diff comments   View file @ 32288eb
... ... @@ -306,26 +306,26 @@
306 306 {
307 307 struct sock *sk = sock->sk;
308 308 struct nr_sock *nr = nr_sk(sk);
309   - int opt;
  309 + unsigned long opt;
310 310  
311 311 if (level != SOL_NETROM)
312 312 return -ENOPROTOOPT;
313 313  
314   - if (optlen < sizeof(int))
  314 + if (optlen < sizeof(unsigned int))
315 315 return -EINVAL;
316 316  
317   - if (get_user(opt, (int __user *)optval))
  317 + if (get_user(opt, (unsigned int __user *)optval))
318 318 return -EFAULT;
319 319  
320 320 switch (optname) {
321 321 case NETROM_T1:
322   - if (opt < 1)
  322 + if (opt < 1 || opt > ULONG_MAX / HZ)
323 323 return -EINVAL;
324 324 nr->t1 = opt * HZ;
325 325 return 0;
326 326  
327 327 case NETROM_T2:
328   - if (opt < 1)
  328 + if (opt < 1 || opt > ULONG_MAX / HZ)
329 329 return -EINVAL;
330 330 nr->t2 = opt * HZ;
331 331 return 0;
332 332  
... ... @@ -337,13 +337,13 @@
337 337 return 0;
338 338  
339 339 case NETROM_T4:
340   - if (opt < 1)
  340 + if (opt < 1 || opt > ULONG_MAX / HZ)
341 341 return -EINVAL;
342 342 nr->t4 = opt * HZ;
343 343 return 0;
344 344  
345 345 case NETROM_IDLE:
346   - if (opt < 0)
  346 + if (opt > ULONG_MAX / (60 * HZ))
347 347 return -EINVAL;
348 348 nr->idle = opt * 60 * HZ;
349 349 return 0;