]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net/rose: prevent integer overflows in rose_setsockopt()
authorNikita Zhandarovich <n.zhandarovich@fintech.ru>
Wed, 15 Jan 2025 16:42:20 +0000 (08:42 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 13 Mar 2025 11:50:00 +0000 (12:50 +0100)
commitb8583b54455cbec2fc038fa32b6700890b369815
treeb7778a44b41d84a31dc159021a4d071a26583663
parent3cfabbb18810043b13f950fb56e776720f4a8ba3
net/rose: prevent integer overflows in rose_setsockopt()

[ Upstream commit d640627663bfe7d8963c7615316d7d4ef60f3b0b ]

In case of possible unpredictably large arguments passed to
rose_setsockopt() and multiplied by extra values on top of that,
integer overflows may occur.

Do the safest minimum and fix these issues by checking the
contents of 'opt' and returning -EINVAL if they are too large. Also,
switch to unsigned int and remove useless check for negative 'opt'
in ROSE_IDLE case.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://patch.msgid.link/20250115164220.19954-1-n.zhandarovich@fintech.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/rose/af_rose.c