A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-31 04:01:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

NET: AX.25: Check ioctl arguments to avoid overflows further down the road.

Browse source 
Very large, nonsenical arguments or use in very extreme conditions could
result in integer overflows.  Check ioctls arguments to avoid such
overflows and return -EINVAL for too large arguments.

To allow the use of AX.25 for even the most extreme setup (think packet
radio to the Phase 5E mars probe) we make no further attempt to clamp the
argument range.

Originally reported by Fan Long <[email protected]> and a first patch
was sent by Xi Wang <[email protected]>.

Signed-off-by: Ralf Baechle <[email protected]>
Cc: Xi Wang <[email protected]>
Cc: Joerg Reuter <[email protected]>
Cc: Alan Cox <[email protected]>
Cc: Thomas Osterried <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
Ralf Baechle 2011-11-24 06:12:59 +00:00 • committed by David S. Miller
commit be639ac690
1 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

17
net/ax25/af_ax25.c
View file

@ -402,14 +402,14 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
break;
case AX25_T1:
if (ax25_ctl.arg < 1)
if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ)
goto einval_put;
ax25->rtt = (ax25_ctl.arg * HZ) / 2;
ax25->t1 = ax25_ctl.arg * HZ;
break;
case AX25_T2:
if (ax25_ctl.arg < 1)
if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ)
goto einval_put;
ax25->t2 = ax25_ctl.arg * HZ;
break;
@ -422,10 +422,15 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
break;
case AX25_T3:
if (ax25_ctl.arg > ULONG_MAX / HZ)
goto einval_put;
ax25->t3 = ax25_ctl.arg * HZ;
break;
case AX25_IDLE:
if (ax25_ctl.arg > ULONG_MAX / (60 * HZ))
goto einval_put;
ax25->idle = ax25_ctl.arg * 60 * HZ;
break;
@ -571,7 +576,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_T1:
if (opt < 1) {
if (opt < 1 || opt > ULONG_MAX / HZ) {
res = -EINVAL;
break;
}
@ -580,7 +585,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_T2:
if (opt < 1) {
if (opt < 1 || opt > ULONG_MAX / HZ) {
res = -EINVAL;
break;
}
@ -596,7 +601,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_T3:
if (opt < 1) {
if (opt < 1 || opt > ULONG_MAX / HZ) {
res = -EINVAL;
break;
}
@ -604,7 +609,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;
case AX25_IDLE:
if (opt < 0) {
if (opt < 0 || opt > ULONG_MAX / (60 * HZ)) {
res = -EINVAL;
break;
}