From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Julian Anastasov <ja@ssi.bg>
Cc: Dan Carpenter <dan.carpenter@linaro.org>,
"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
Simon Horman <horms@verge.net.au>,
Jozsef Kadlecsik <kadlec@netfilter.org>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
netdev@vger.kernel.org, lvs-devel@vger.kernel.org,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [PATCH v2 net] ipvs: prevent integer overflow in do_ip_vs_get_ctl()
Date: Wed, 12 Mar 2025 15:48:44 +0100 [thread overview]
Message-ID: <Z9GezONZJ_sDuwFy@calendula> (raw)
In-Reply-To: <262d87d6-9620-eef4-3d36-93d9e0dc478c@ssi.bg>
On Tue, Mar 11, 2025 at 07:50:44PM +0200, Julian Anastasov wrote:
>
> Hello,
>
> On Mon, 10 Mar 2025, Dan Carpenter wrote:
>
> > The get->num_services variable is an unsigned int which is controlled by
> > the user. The struct_size() function ensures that the size calculation
> > does not overflow an unsigned long, however, we are saving the result to
> > an int so the calculation can overflow.
> >
> > Both "len" and "get->num_services" come from the user. This check is
> > just a sanity check to help the user and ensure they are using the API
> > correctly. An integer overflow here is not a big deal. This has no
> > security impact.
> >
> > Save the result from struct_size() type size_t to fix this integer
> > overflow bug.
> >
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
>
> Looks good to me, thanks!
>
> Acked-by: Julian Anastasov <ja@ssi.bg>
>
> Pablo, you can apply it to the nf tree.
Done, thanks Julian.
prev parent reply other threads:[~2025-03-12 14:48 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-10 7:45 [PATCH v2 net] ipvs: prevent integer overflow in do_ip_vs_get_ctl() Dan Carpenter
2025-03-11 17:50 ` Julian Anastasov
2025-03-12 14:48 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Z9GezONZJ_sDuwFy@calendula \
--to=pablo@netfilter.org \
--cc=coreteam@netfilter.org \
--cc=dan.carpenter@linaro.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=gustavo@embeddedor.com \
--cc=horms@verge.net.au \
--cc=ja@ssi.bg \
--cc=kadlec@netfilter.org \
--cc=kernel-janitors@vger.kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lvs-devel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).