lkml.org 
[lkml]   [2014]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.8 154/166] drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()
    Date
    3.8.13.16 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Wenliang Fan <fanwlexca@gmail.com>

    [ Upstream commit e9db5c21d3646a6454fcd04938dd215ac3ab620a ]

    The local variable 'bi' comes from userspace. If userspace passed a
    large number to 'bi.data.calibrate', there would be an integer overflow
    in the following line:
    s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;

    Signed-off-by: Wenliang Fan <fanwlexca@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/net/hamradio/hdlcdrv.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
    index a4a3516..3b3a7e0 100644
    --- a/drivers/net/hamradio/hdlcdrv.c
    +++ b/drivers/net/hamradio/hdlcdrv.c
    @@ -571,6 +571,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
    case HDLCDRVCTL_CALIBRATE:
    if(!capable(CAP_SYS_RAWIO))
    return -EPERM;
    + if (bi.data.calibrate > INT_MAX / s->par.bitrate)
    + return -EINVAL;
    s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
    return 0;

    --
    1.8.3.2


    \
     
     \ /
      Last update: 2014-01-15 23:41    [W:4.361 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site