[PATCH] rose: correct integer overflow check

[PATCH] rose: correct integer overflow check

[Insu Yun]

Since rose_ndevs is signed integer type,
it can be overflowed when it is negative.

Signed-off-by: Insu Yun <wuninsu@gmail.com>
---
 net/rose/af_rose.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 129d357..4f37fae 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1514,7 +1514,8 @@ static int __init rose_proto_init(void)
 	int i;
 	int rc;
 
-	if (rose_ndevs > 0x7FFFFFFF/sizeof(struct net_device *)) {
+	if (rose_ndevs < 0 ||
+	    rose_ndevs > 0x7FFFFFFF / sizeof(struct net_device *)) {
 		printk(KERN_ERR "ROSE: rose_proto_init - rose_ndevs parameter to large\n");
 		rc = -EINVAL;
 		goto out;
-- 
1.9.1

Re: [PATCH] rose: correct integer overflow check

[David Miller]

From: Insu Yun <wuninsu@gmail.com>
Date: Wed, 17 Feb 2016 15:25:13 -0500

> Since rose_ndevs is signed integer type,
> it can be overflowed when it is negative.
> 
> Signed-off-by: Insu Yun <wuninsu@gmail.com>

That's not how the expression is evaluated.

Because of the types on the right hand side of the comparison
the expressions are all promoted to unsigned.

Did you look at the compiler's assembler output?  I did when
reviewing your patch.

Re: [PATCH] rose: correct integer overflow check

[Ralf Baechle]

On Thu, Feb 18, 2016 at 04:03:16PM -0500, Insu Yun wrote:

> 
>     Because of the types on the right hand side of the comparison
>     the expressions are all promoted to unsigned.
> 
>     Did you look at the compiler's assembler output?  I did when
>     reviewing your patch.
> 
> 
> I checked the assembler output right now.
> You are right.
> I realized that right hand side becomes unsigned due to sizeof.
> I think this patch is wrong. 
> Thanks. 

On a different level, the current whole approach of ROSE to just generate
a fixed number of devices at initialization time of ROSE is if not wrong
then at least very archaic.  The default number is 10 devices and probably
of those 9 are unused on a typical setup - that is, if the module has
been loaded intentionally at all.

As a solution I've implemented a patch to support creating of ROSE
devices through netlink plus the necessary changes to iproute2 to go
along with that.

  Ralf
--
To unsubscribe from this list: send the line "unsubscribe linux-hams" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] rose: correct integer overflow check

[Ralf Baechle]

On Thu, Feb 18, 2016 at 04:03:16PM -0500, Insu Yun wrote:

> 
>     Because of the types on the right hand side of the comparison
>     the expressions are all promoted to unsigned.
> 
>     Did you look at the compiler's assembler output?  I did when
>     reviewing your patch.
> 
> 
> I checked the assembler output right now.
> You are right.
> I realized that right hand side becomes unsigned due to sizeof.
> I think this patch is wrong. 
> Thanks. 

On a different level, the current whole approach of ROSE to just generate
a fixed number of devices at initialization time of ROSE is if not wrong
then at least very archaic.  The default number is 10 devices and probably
of those 9 are unused on a typical setup - that is, if the module has
been loaded intentionally at all.

As a solution I've implemented a patch to support creating of ROSE
devices through netlink plus the necessary changes to iproute2 to go
along with that.

  Ralf