summaryrefslogtreecommitdiffstats
path: root/net/packet
diff options
context:
space:
mode:
authorKal Conley <kal.conley@dectris.com>2019-02-10 09:57:11 +0100
committerDavid S. Miller <davem@davemloft.net>2019-02-12 13:37:23 -0500
commitfc62814d690cf62189854464f4bd07457d5e9e50 (patch)
treef4764002a6cc91fdfea00ecbc690e787c9bba974 /net/packet
parent1ec17dbd90f8b638f41ee650558609c1af63dfa0 (diff)
downloadlinux-stable-fc62814d690cf62189854464f4bd07457d5e9e50.tar.gz
linux-stable-fc62814d690cf62189854464f4bd07457d5e9e50.tar.bz2
linux-stable-fc62814d690cf62189854464f4bd07457d5e9e50.zip
net/packet: fix 4gb buffer limit due to overflow check
When calculating rb->frames_per_block * req->tp_block_nr the result can overflow. Check it for overflow without limiting the total buffer size to UINT_MAX. This change fixes support for packet ring buffers >= UINT_MAX. Fixes: 8f8d28e4d6d8 ("net/packet: fix overflow in check for tp_frame_nr") Signed-off-by: Kal Conley <kal.conley@dectris.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/packet')
-rw-r--r--net/packet/af_packet.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 3b1a78906bc0..1cd1d83a4be0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4292,7 +4292,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
rb->frames_per_block = req->tp_block_size / req->tp_frame_size;
if (unlikely(rb->frames_per_block == 0))
goto out;
- if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
+ if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr))
goto out;
if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
req->tp_frame_nr))