From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: Re: [patch -stable] igbvf: integer wrapping bug setting the mtu Date: Fri, 13 Sep 2013 12:54:23 +0300 Message-ID: <20130913095423.GH19256@mwanda> References: <20130913083736.GK19211@elgon.mountain> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: kernel-janitors@vger.kernel.org, netdev@vger.kernel.org, Patrick McHardy , e1000-devel@lists.sourceforge.net, Bruce Allan , Jesse Brandeburg , "David S. Miller" , John Ronciak , Greg Kroah-Hartman To: David Laight Return-path: Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: e1000-devel-bounces@lists.sourceforge.net List-Id: netdev.vger.kernel.org On Fri, Sep 13, 2013 at 09:58:25AM +0100, David Laight wrote: > > If new_mtu is very large then "new_mtu + ETH_HLEN + ETH_FCS_LEN" can > > wrap and the check on the next line can underflow. This is one of those > > bugs which can be triggered by the user if you have namespaces > > configured. > > > > This is a static checker fix and I'm not sure what the impact is. > > > > Signed-off-by: Dan Carpenter > > > > diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c > > index 95d5430..24e3883 100644 > > --- a/drivers/net/ethernet/intel/igbvf/netdev.c > > +++ b/drivers/net/ethernet/intel/igbvf/netdev.c > > @@ -2342,7 +2342,7 @@ static struct net_device_stats *igbvf_get_stats(struct net_device *netdev) > > static int igbvf_change_mtu(struct net_device *netdev, int new_mtu) > > { > > struct igbvf_adapter *adapter = netdev_priv(netdev); > > - int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN; > > + unsigned int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN; > > > > if ((new_mtu < 68) || (max_frame > MAX_JUMBO_FRAME_SIZE)) { > > dev_err(&adapter->pdev->dev, "Invalid MTU setting\n"); > > It is safer to check: > if ((new_mtu < 68) || (new_mtu > MAX_JUMBO_FRAME_SIZE - ETH_HLEN - ETH_FCS_LEN)) { > I believe my fix is already 100% safe... Where is the bug in my code? Your fix harder to read because of the additional math and because it's checking "new_mtu" when we care about "max_frame". regards, dan carpenter ------------------------------------------------------------------------------ How ServiceNow helps IT people transform IT departments: 1. Consolidate legacy IT systems to a single system of record for IT 2. Standardize and globalize service processes across IT 3. Implement zero-touch automation to replace manual, redundant tasks http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk _______________________________________________ E1000-devel mailing list E1000-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/e1000-devel To learn more about Intel® Ethernet, visit http://communities.intel.com/community/wired