Commit be639ac6 authored by Ralf Baechle's avatar Ralf Baechle Committed by David S. Miller

NET: AX.25: Check ioctl arguments to avoid overflows further down the road.

Very large, nonsenical arguments or use in very extreme conditions could
result in integer overflows.  Check ioctls arguments to avoid such
overflows and return -EINVAL for too large arguments.

To allow the use of AX.25 for even the most extreme setup (think packet
radio to the Phase 5E mars probe) we make no further attempt to clamp the
argument range.

Originally reported by Fan Long <longfancn@gmail.com> and a first patch
was sent by Xi Wang <xi.wang@gmail.com>.
Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
Cc: Xi Wang <xi.wang@gmail.com>
Cc: Joerg Reuter <jreuter@yaina.de>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Thomas Osterried <thomas@osterried.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3b158859
...@@ -402,14 +402,14 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) ...@@ -402,14 +402,14 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
break; break;
case AX25_T1: case AX25_T1:
if (ax25_ctl.arg < 1) if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ)
goto einval_put; goto einval_put;
ax25->rtt = (ax25_ctl.arg * HZ) / 2; ax25->rtt = (ax25_ctl.arg * HZ) / 2;
ax25->t1 = ax25_ctl.arg * HZ; ax25->t1 = ax25_ctl.arg * HZ;
break; break;
case AX25_T2: case AX25_T2:
if (ax25_ctl.arg < 1) if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ)
goto einval_put; goto einval_put;
ax25->t2 = ax25_ctl.arg * HZ; ax25->t2 = ax25_ctl.arg * HZ;
break; break;
...@@ -422,10 +422,15 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) ...@@ -422,10 +422,15 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
break; break;
case AX25_T3: case AX25_T3:
if (ax25_ctl.arg > ULONG_MAX / HZ)
goto einval_put;
ax25->t3 = ax25_ctl.arg * HZ; ax25->t3 = ax25_ctl.arg * HZ;
break; break;
case AX25_IDLE: case AX25_IDLE:
if (ax25_ctl.arg > ULONG_MAX / (60 * HZ))
goto einval_put;
ax25->idle = ax25_ctl.arg * 60 * HZ; ax25->idle = ax25_ctl.arg * 60 * HZ;
break; break;
...@@ -571,7 +576,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, ...@@ -571,7 +576,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_T1: case AX25_T1:
if (opt < 1) { if (opt < 1 || opt > ULONG_MAX / HZ) {
res = -EINVAL; res = -EINVAL;
break; break;
} }
...@@ -580,7 +585,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, ...@@ -580,7 +585,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_T2: case AX25_T2:
if (opt < 1) { if (opt < 1 || opt > ULONG_MAX / HZ) {
res = -EINVAL; res = -EINVAL;
break; break;
} }
...@@ -596,7 +601,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, ...@@ -596,7 +601,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_T3: case AX25_T3:
if (opt < 1) { if (opt < 1 || opt > ULONG_MAX / HZ) {
res = -EINVAL; res = -EINVAL;
break; break;
} }
...@@ -604,7 +609,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, ...@@ -604,7 +609,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break; break;
case AX25_IDLE: case AX25_IDLE:
if (opt < 0) { if (opt < 0 || opt > ULONG_MAX / (60 * HZ)) {
res = -EINVAL; res = -EINVAL;
break; break;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment