From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Thu, 20 Jun 2013 12:23:52 +0200 From: Pablo Neira Ayuso Message-ID: <20130620102352.GA19813@localhost> References: <20130618074603.GF12329@elgon.mountain> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20130618074603.GF12329@elgon.mountain> Subject: Re: [Bridge] [patch] netfilter: prevent harmless integer overflow List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Dan Carpenter Cc: coreteam@netfilter.org, netdev@vger.kernel.org, bridge@lists.linux-foundation.org, kernel-janitors@vger.kernel.org, "David S. Miller" , Stephen Hemminger , netfilter@vger.kernel.org, Bart De Schuymer , netfilter-devel@vger.kernel.org, Patrick McHardy On Tue, Jun 18, 2013 at 10:46:03AM +0300, Dan Carpenter wrote: > This overflow is harmless because a few lines later we check: > > if (num_counters != t->private->nentries) { > > But it still upsets the static checkers. > > Signed-off-by: Dan Carpenter > > diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c > index 3d110c4..141350e 100644 > --- a/net/bridge/netfilter/ebtables.c > +++ b/net/bridge/netfilter/ebtables.c > @@ -1278,6 +1278,8 @@ static int do_update_counters(struct net *net, const char *name, > > if (num_counters == 0) > return -EINVAL; > + if (num_counters > INT_MAX / sizeof(*tmp)) > + return -ENOMEM; This is artificially limiting to INT_MAX / sizeof(struct counters). Before this patch, the limit is UINT_MAX / sizeof(struct counters). I think it's very unlikely to hit such a limit though, but as you mentioned we cover the overflow already. Adding it to calm down a static checker sound a bit too much for me.