* [PATCH] usbnet: avoid integer overflow in start_xmit
@ 2015-05-06 13:09 Jason A. Donenfeld
2015-05-09 20:46 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Jason A. Donenfeld @ 2015-05-06 13:09 UTC (permalink / raw)
To: oneukum, netdev; +Cc: Jason A. Donenfeld
transfer_buffer_length is of type u32. It's therefore wrong to assign it
to a signed integer. This patch avoids the overflow.
It's worth noting that entry->length here is a long; perhaps it would be
beneficial at somepoint to change this to be unsigned as well, if
nothing else relies on its signedness for error conditions or the like.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
drivers/net/usb/usbnet.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 733f4fe..3c86b10 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1285,7 +1285,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
struct net_device *net)
{
struct usbnet *dev = netdev_priv(net);
- int length;
+ unsigned int length;
struct urb *urb = NULL;
struct skb_data *entry;
struct driver_info *info = dev->driver_info;
@@ -1413,7 +1413,7 @@ not_drop:
}
} else
netif_dbg(dev, tx_queued, dev->net,
- "> tx, len %d, type 0x%x\n", length, skb->protocol);
+ "> tx, len %u, type 0x%x\n", length, skb->protocol);
#ifdef CONFIG_PM
deferred:
#endif
--
2.3.6
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] usbnet: avoid integer overflow in start_xmit
2015-05-06 13:09 [PATCH] usbnet: avoid integer overflow in start_xmit Jason A. Donenfeld
@ 2015-05-09 20:46 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2015-05-09 20:46 UTC (permalink / raw)
To: Jason; +Cc: oneukum, netdev
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
Date: Wed, 6 May 2015 15:09:40 +0200
> transfer_buffer_length is of type u32. It's therefore wrong to assign it
> to a signed integer. This patch avoids the overflow.
>
> It's worth noting that entry->length here is a long; perhaps it would be
> beneficial at somepoint to change this to be unsigned as well, if
> nothing else relies on its signedness for error conditions or the like.
>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-05-09 20:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-05-06 13:09 [PATCH] usbnet: avoid integer overflow in start_xmit Jason A. Donenfeld
2015-05-09 20:46 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).