From be639ac6901a082894771f55c8047d5772de5c27 Mon Sep 17 00:00:00 2001 From: Ralf Baechle Date: Thu, 24 Nov 2011 06:12:59 +0000 Subject: NET: AX.25: Check ioctl arguments to avoid overflows further down the road. Very large, nonsenical arguments or use in very extreme conditions could result in integer overflows. Check ioctls arguments to avoid such overflows and return -EINVAL for too large arguments. To allow the use of AX.25 for even the most extreme setup (think packet radio to the Phase 5E mars probe) we make no further attempt to clamp the argument range. Originally reported by Fan Long and a first patch was sent by Xi Wang . Signed-off-by: Ralf Baechle Cc: Xi Wang Cc: Joerg Reuter Cc: Alan Cox Cc: Thomas Osterried Signed-off-by: David S. Miller --- net/ax25/af_ax25.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) (limited to 'net/ax25/af_ax25.c') diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index e7c69f4619e..b863c1877c8 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -402,14 +402,14 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) break; case AX25_T1: - if (ax25_ctl.arg < 1) + if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ) goto einval_put; ax25->rtt = (ax25_ctl.arg * HZ) / 2; ax25->t1 = ax25_ctl.arg * HZ; break; case AX25_T2: - if (ax25_ctl.arg < 1) + if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ) goto einval_put; ax25->t2 = ax25_ctl.arg * HZ; break; @@ -422,10 +422,15 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) break; case AX25_T3: + if (ax25_ctl.arg > ULONG_MAX / HZ) + goto einval_put; ax25->t3 = ax25_ctl.arg * HZ; break; case AX25_IDLE: + if (ax25_ctl.arg > ULONG_MAX / (60 * HZ)) + goto einval_put; + ax25->idle = ax25_ctl.arg * 60 * HZ; break; @@ -571,7 +576,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, break; case AX25_T1: - if (opt < 1) { + if (opt < 1 || opt > ULONG_MAX / HZ) { res = -EINVAL; break; } @@ -580,7 +585,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, break; case AX25_T2: - if (opt < 1) { + if (opt < 1 || opt > ULONG_MAX / HZ) { res = -EINVAL; break; } @@ -596,7 +601,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, break; case AX25_T3: - if (opt < 1) { + if (opt < 1 || opt > ULONG_MAX / HZ) { res = -EINVAL; break; } @@ -604,7 +609,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, break; case AX25_IDLE: - if (opt < 0) { + if (opt < 0 || opt > ULONG_MAX / (60 * HZ)) { res = -EINVAL; break; } -- cgit v1.2.3-70-g09d2 From ba1cffe0257bcd4d0070bc0e64f8ead97fefd148 Mon Sep 17 00:00:00 2001 From: Xi Wang Date: Tue, 27 Dec 2011 09:43:19 +0000 Subject: ax25: avoid overflows in ax25_setsockopt() Commit be639ac6 ("NET: AX.25: Check ioctl arguments to avoid overflows further down the road") rejects very large arguments, but doesn't completely fix overflows on 64-bit systems. Consider the AX25_T2 case. int opt; ... if (opt < 1 || opt > ULONG_MAX / HZ) { res = -EINVAL; break; } ax25->t2 = opt * HZ; The 32-bit multiplication opt * HZ would overflow before being assigned to 64-bit ax25->t2. This patch changes "opt" to unsigned long. Signed-off-by: Xi Wang Cc: Ralf Baechle Signed-off-by: David S. Miller --- net/ax25/af_ax25.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'net/ax25/af_ax25.c') diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index b863c1877c8..3cd0a0dc91c 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -545,15 +545,16 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, ax25_cb *ax25; struct net_device *dev; char devname[IFNAMSIZ]; - int opt, res = 0; + unsigned long opt; + int res = 0; if (level != SOL_AX25) return -ENOPROTOOPT; - if (optlen < sizeof(int)) + if (optlen < sizeof(unsigned int)) return -EINVAL; - if (get_user(opt, (int __user *)optval)) + if (get_user(opt, (unsigned int __user *)optval)) return -EFAULT; lock_sock(sk); @@ -609,7 +610,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, break; case AX25_IDLE: - if (opt < 0 || opt > ULONG_MAX / (60 * HZ)) { + if (opt > ULONG_MAX / (60 * HZ)) { res = -EINVAL; break; } @@ -617,7 +618,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, break; case AX25_BACKOFF: - if (opt < 0 || opt > 2) { + if (opt > 2) { res = -EINVAL; break; } -- cgit v1.2.3-70-g09d2