]> www.infradead.org Git - users/dwmw2/linux.git/commit
net/rose: prevent integer overflows in rose_setsockopt()
authorNikita Zhandarovich <n.zhandarovich@fintech.ru>
Wed, 15 Jan 2025 16:42:20 +0000 (08:42 -0800)
committerJakub Kicinski <kuba@kernel.org>
Tue, 21 Jan 2025 00:36:33 +0000 (16:36 -0800)
commitd640627663bfe7d8963c7615316d7d4ef60f3b0b
tree791aa6f47ee1a4c641a0664f87137f95887e2a3a
parent25c1a9ca53db5780757e7f53e688b8f916821baa
net/rose: prevent integer overflows in rose_setsockopt()

In case of possible unpredictably large arguments passed to
rose_setsockopt() and multiplied by extra values on top of that,
integer overflows may occur.

Do the safest minimum and fix these issues by checking the
contents of 'opt' and returning -EINVAL if they are too large. Also,
switch to unsigned int and remove useless check for negative 'opt'
in ROSE_IDLE case.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://patch.msgid.link/20250115164220.19954-1-n.zhandarovich@fintech.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/rose/af_rose.c