* [PATCH] drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()
@ 2013-12-17 3:25 Wenliang Fan
2013-12-19 20:03 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Wenliang Fan @ 2013-12-17 3:25 UTC (permalink / raw)
To: davem, michael.opdenacker, gaofeng, akpm, t.sailer
Cc: netdev, linux-kernel, Wenliang Fan
The local variable 'bi' comes from userspace. If userspace passed a
large number to 'bi.data.calibrate', there would be an integer overflow
in the following line:
s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
Signed-off-by: Wenliang Fan <fanwlexca@gmail.com>
---
drivers/net/hamradio/hdlcdrv.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 3169252..5d78c1d 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -571,6 +571,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
case HDLCDRVCTL_CALIBRATE:
if(!capable(CAP_SYS_RAWIO))
return -EPERM;
+ if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+ return -EINVAL;
s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
return 0;
--
1.8.5.rc1.28.g7061504
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-12-19 20:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-12-17 3:25 [PATCH] drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl() Wenliang Fan
2013-12-19 20:03 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).