linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Andrey Konovalov <andreyknvl@google.com>,
	Eric Dumazet <edumazet@google.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 25/31] net/packet: fix overflow in check for priv area size
Date: Sun, 16 Apr 2017 10:04:16 +0200	[thread overview]
Message-ID: <20170416080223.097959631@linuxfoundation.org> (raw)
In-Reply-To: <20170416080221.808058771@linuxfoundation.org>

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrey Konovalov <andreyknvl@google.com>

commit 2b6867c2ce76c596676bec7d2d525af525fdc6e2 upstream.

Subtracting tp_sizeof_priv from tp_block_size and casting to int
to check whether one is less then the other doesn't always work
(both of them are unsigned ints).

Compare them as is instead.

Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as
it can overflow inside BLK_PLUS_PRIV otherwise.

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/packet/af_packet.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4235,8 +4235,8 @@ static int packet_set_ring(struct sock *
 		if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
 			goto out;
 		if (po->tp_version >= TPACKET_V3 &&
-		    (int)(req->tp_block_size -
-			  BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
+		    req->tp_block_size <=
+			  BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
 			goto out;
 		if (unlikely(req->tp_frame_size < po->tp_hdrlen +
 					po->tp_reserve))

  parent reply	other threads:[~2017-04-16  8:05 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-04-16  8:03 [PATCH 4.9 00/31] 4.9.23-stable review Greg Kroah-Hartman
2017-04-16  8:03 ` [PATCH 4.9 05/31] drm/i915: Drop support for I915_EXEC_CONSTANTS_* execbuf parameters Greg Kroah-Hartman
2017-04-16  8:03 ` [PATCH 4.9 06/31] drm/i915: Stop using RP_DOWN_EI on Baytrail Greg Kroah-Hartman
2017-04-16  8:03 ` [PATCH 4.9 07/31] drm/i915: Avoid rcu_barrier() from reclaim paths (shrinker) Greg Kroah-Hartman
2017-04-16  8:03 ` [PATCH 4.9 08/31] orangefs: fix memory leak of string new on exit path Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 09/31] orangefs: Dan Carpenter influenced cleanups Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 10/31] orangefs: fix buffer size mis-match between kernel space and user space Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 12/31] rt2x00usb: fix anchor initialization Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 13/31] rt2x00usb: do not anchor rx and tx urbs Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 14/31] rt2x00: Fix incorrect usage of CONFIG_RT2X00_LIB_USB Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 16/31] MIPS: Introduce irq_stack Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 17/31] MIPS: Stack unwinding while on IRQ stack Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 18/31] MIPS: Only change $28 to thread_info if coming from user mode Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 19/31] MIPS: Switch to the irq_stack in interrupts Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 20/31] MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 21/31] MIPS: IRQ Stack: Fix erroneous jal to plat_irq_dispatch Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 24/31] [PATCH] Revert "drm/i915/execlists: Reset RING registers upon resume" Greg Kroah-Hartman
2017-04-16  8:04 ` Greg Kroah-Hartman [this message]
2017-04-16  8:04 ` [PATCH 4.9 26/31] blk-mq: Avoid memory reclaim when remapping queues Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 27/31] usb: hub: Wait for connection to be reestablished after port reset Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 28/31] net/mlx4_en: Fix bad WQE issue Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 29/31] net/mlx4_core: Fix racy CQ (Completion Queue) free Greg Kroah-Hartman
2017-04-16  8:04 ` [PATCH 4.9 30/31] net/mlx4_core: Fix when to save some qp context flags for dynamic VST to VGT transitions Greg Kroah-Hartman
2017-04-16 21:29 ` [PATCH 4.9 00/31] 4.9.23-stable review Guenter Roeck
2017-04-17 18:21 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170416080223.097959631@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=andreyknvl@google.com \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).