* [PATCH net] ptr_ring: prevent integer overflow when calculating size
@ 2018-02-11 3:28 Jason Wang
2018-02-11 22:02 ` Michael S. Tsirkin
2018-02-12 3:34 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Jason Wang @ 2018-02-11 3:28 UTC (permalink / raw)
To: linux-kernel, netdev; +Cc: mst, ebiggers3, Jason Wang
Switch to use dividing to prevent integer overflow when size is too
big to calculate allocation size properly.
Reported-by: Eric Biggers <ebiggers3@gmail.com>
Fixes: 6e6e41c31122 ("ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE")
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
include/linux/ptr_ring.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
index b884b77..e633522 100644
--- a/include/linux/ptr_ring.h
+++ b/include/linux/ptr_ring.h
@@ -469,7 +469,7 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,
*/
static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
{
- if (size * sizeof(void *) > KMALLOC_MAX_SIZE)
+ if (size > KMALLOC_MAX_SIZE / sizeof(void *))
return NULL;
return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO);
}
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net] ptr_ring: prevent integer overflow when calculating size
2018-02-11 3:28 [PATCH net] ptr_ring: prevent integer overflow when calculating size Jason Wang
@ 2018-02-11 22:02 ` Michael S. Tsirkin
2018-02-12 3:34 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Michael S. Tsirkin @ 2018-02-11 22:02 UTC (permalink / raw)
To: Jason Wang; +Cc: linux-kernel, netdev, ebiggers3
On Sun, Feb 11, 2018 at 11:28:12AM +0800, Jason Wang wrote:
> Switch to use dividing to prevent integer overflow when size is too
> big to calculate allocation size properly.
>
> Reported-by: Eric Biggers <ebiggers3@gmail.com>
> Fixes: 6e6e41c31122 ("ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE")
> Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
> ---
> include/linux/ptr_ring.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
> index b884b77..e633522 100644
> --- a/include/linux/ptr_ring.h
> +++ b/include/linux/ptr_ring.h
> @@ -469,7 +469,7 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,
> */
> static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
> {
> - if (size * sizeof(void *) > KMALLOC_MAX_SIZE)
> + if (size > KMALLOC_MAX_SIZE / sizeof(void *))
> return NULL;
> return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO);
> }
> --
> 2.7.4
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net] ptr_ring: prevent integer overflow when calculating size
2018-02-11 3:28 [PATCH net] ptr_ring: prevent integer overflow when calculating size Jason Wang
2018-02-11 22:02 ` Michael S. Tsirkin
@ 2018-02-12 3:34 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2018-02-12 3:34 UTC (permalink / raw)
To: jasowang; +Cc: linux-kernel, netdev, mst, ebiggers3
From: Jason Wang <jasowang@redhat.com>
Date: Sun, 11 Feb 2018 11:28:12 +0800
> Switch to use dividing to prevent integer overflow when size is too
> big to calculate allocation size properly.
>
> Reported-by: Eric Biggers <ebiggers3@gmail.com>
> Fixes: 6e6e41c31122 ("ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE")
> Signed-off-by: Jason Wang <jasowang@redhat.com>
Applied and queued up for -stable, thanks Jason.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-02-12 3:34 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-02-11 3:28 [PATCH net] ptr_ring: prevent integer overflow when calculating size Jason Wang
2018-02-11 22:02 ` Michael S. Tsirkin
2018-02-12 3:34 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).