diff options
| author | Xi Wang <xi.wang@gmail.com> | 2011-12-27 09:44:53 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-12-28 14:08:08 -0500 |
| commit | 32288eb4d940b10e40c6d4178fe3a40d1437d2f8 (patch) | |
| tree | 7cdd2b53eae8b6381eec1ddd497f28615277f1c2 /net/netrom | |
| parent | ba1cffe0257bcd4d0070bc0e64f8ead97fefd148 (diff) | |
| download | linux-32288eb4d940b10e40c6d4178fe3a40d1437d2f8.tar.gz linux-32288eb4d940b10e40c6d4178fe3a40d1437d2f8.tar.bz2 linux-32288eb4d940b10e40c6d4178fe3a40d1437d2f8.zip | |
netrom: avoid overflows in nr_setsockopt()
Check setsockopt arguments to avoid overflows and return -EINVAL for
too large arguments.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netrom')
| -rw-r--r-- | net/netrom/af_netrom.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index c329b474eace..7dab229bfbcc 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -306,26 +306,26 @@ static int nr_setsockopt(struct socket *sock, int level, int optname, { struct sock *sk = sock->sk; struct nr_sock *nr = nr_sk(sk); - int opt; + unsigned long opt; if (level != SOL_NETROM) return -ENOPROTOOPT; - if (optlen < sizeof(int)) + if (optlen < sizeof(unsigned int)) return -EINVAL; - if (get_user(opt, (int __user *)optval)) + if (get_user(opt, (unsigned int __user *)optval)) return -EFAULT; switch (optname) { case NETROM_T1: - if (opt < 1) + if (opt < 1 || opt > ULONG_MAX / HZ) return -EINVAL; nr->t1 = opt * HZ; return 0; case NETROM_T2: - if (opt < 1) + if (opt < 1 || opt > ULONG_MAX / HZ) return -EINVAL; nr->t2 = opt * HZ; return 0; @@ -337,13 +337,13 @@ static int nr_setsockopt(struct socket *sock, int level, int optname, return 0; case NETROM_T4: - if (opt < 1) + if (opt < 1 || opt > ULONG_MAX / HZ) return -EINVAL; nr->t4 = opt * HZ; return 0; case NETROM_IDLE: - if (opt < 0) + if (opt > ULONG_MAX / (60 * HZ)) return -EINVAL; nr->idle = opt * 60 * HZ; return 0; |