lkml.org 
[lkml]   [2014]   [Jan]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.11 182/208] drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()
    Date
    3.11.10.3 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Wenliang Fan <fanwlexca@gmail.com>

    commit e9db5c21d3646a6454fcd04938dd215ac3ab620a upstream.

    The local variable 'bi' comes from userspace. If userspace passed a
    large number to 'bi.data.calibrate', there would be an integer overflow
    in the following line:
    s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;

    Signed-off-by: Wenliang Fan <fanwlexca@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    drivers/net/hamradio/hdlcdrv.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
    index 3169252..5d78c1d 100644
    --- a/drivers/net/hamradio/hdlcdrv.c
    +++ b/drivers/net/hamradio/hdlcdrv.c
    @@ -571,6 +571,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
    case HDLCDRVCTL_CALIBRATE:
    if(!capable(CAP_SYS_RAWIO))
    return -EPERM;
    + if (bi.data.calibrate > INT_MAX / s->par.bitrate)
    + return -EINVAL;
    s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
    return 0;

    --
    1.8.3.2


    \
     
     \ /
      Last update: 2014-01-13 18:01    [W:4.143 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site