Commit be639ac6901a082894771f55c8047d5772de5c27

Authored by Ralf Baechle
Committed by David S. Miller
1 parent 3b15885930

NET: AX.25: Check ioctl arguments to avoid overflows further down the road.

Very large, nonsenical arguments or use in very extreme conditions could
result in integer overflows.  Check ioctls arguments to avoid such
overflows and return -EINVAL for too large arguments.

To allow the use of AX.25 for even the most extreme setup (think packet
radio to the Phase 5E mars probe) we make no further attempt to clamp the
argument range.

Originally reported by Fan Long <longfancn@gmail.com> and a first patch
was sent by Xi Wang <xi.wang@gmail.com>.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Cc: Xi Wang <xi.wang@gmail.com>
Cc: Joerg Reuter <jreuter@yaina.de>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Thomas Osterried <thomas@osterried.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 11 additions and 6 deletions Side-by-side Diff

... ... @@ -402,14 +402,14 @@
402 402 break;
403 403  
404 404 case AX25_T1:
405   - if (ax25_ctl.arg < 1)
  405 + if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ)
406 406 goto einval_put;
407 407 ax25->rtt = (ax25_ctl.arg * HZ) / 2;
408 408 ax25->t1 = ax25_ctl.arg * HZ;
409 409 break;
410 410  
411 411 case AX25_T2:
412   - if (ax25_ctl.arg < 1)
  412 + if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ)
413 413 goto einval_put;
414 414 ax25->t2 = ax25_ctl.arg * HZ;
415 415 break;
416 416  
... ... @@ -422,10 +422,15 @@
422 422 break;
423 423  
424 424 case AX25_T3:
  425 + if (ax25_ctl.arg > ULONG_MAX / HZ)
  426 + goto einval_put;
425 427 ax25->t3 = ax25_ctl.arg * HZ;
426 428 break;
427 429  
428 430 case AX25_IDLE:
  431 + if (ax25_ctl.arg > ULONG_MAX / (60 * HZ))
  432 + goto einval_put;
  433 +
429 434 ax25->idle = ax25_ctl.arg * 60 * HZ;
430 435 break;
431 436  
... ... @@ -571,7 +576,7 @@
571 576 break;
572 577  
573 578 case AX25_T1:
574   - if (opt < 1) {
  579 + if (opt < 1 || opt > ULONG_MAX / HZ) {
575 580 res = -EINVAL;
576 581 break;
577 582 }
... ... @@ -580,7 +585,7 @@
580 585 break;
581 586  
582 587 case AX25_T2:
583   - if (opt < 1) {
  588 + if (opt < 1 || opt > ULONG_MAX / HZ) {
584 589 res = -EINVAL;
585 590 break;
586 591 }
... ... @@ -596,7 +601,7 @@
596 601 break;
597 602  
598 603 case AX25_T3:
599   - if (opt < 1) {
  604 + if (opt < 1 || opt > ULONG_MAX / HZ) {
600 605 res = -EINVAL;
601 606 break;
602 607 }
... ... @@ -604,7 +609,7 @@
604 609 break;
605 610  
606 611 case AX25_IDLE:
607   - if (opt < 0) {
  612 + if (opt < 0 || opt > ULONG_MAX / (60 * HZ)) {
608 613 res = -EINVAL;
609 614 break;
610 615 }