kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-09 18:15:49 +00:00
Code Issues Releases Packages Activity
linux/drivers/staging/most
History
Andrey Shvetsov 791f6de9e3 staging: most: net: fix buffer overflow 
commit 4d1356ac12 upstream.

If the length of the socket buffer is 0xFFFFFFFF (max size for an
unsigned int), then payload_len becomes 0xFFFFFFF1 after subtracting 14
(ETH_HLEN).  Then, mdp_len is set to payload_len + 16 (MDP_HDR_LEN)
which overflows and results in a value of 2.  These values for
payload_len and mdp_len will pass current buffer size checks.

This patch checks if derived from skb->len sum may overflow.

The check is based on the following idea:

For any `unsigned V1, V2` and derived `unsigned SUM = V1 + V2`,
`V1 + V2` overflows iif `SUM < V1`.

Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrey Shvetsov <andrey.shvetsov@k2l.de>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200116172238.6046-1-andrey.shvetsov@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2020-02-01 09:32:53 +00:00
..
cdev staging: most: block module removal while having active configfs items 2019-11-11 16:41:00 +01:00
dim2 staging: Remove dev_err() usage after platform_get_irq() 2019-07-30 20:50:04 +02:00
Documentation staging: most: trivial: fix a couple of typos 2019-06-06 15:03:34 +02:00
i2c staging: add missing SPDX lines to Makefile files 2019-04-03 11:10:15 +02:00
net staging: most: net: fix buffer overflow 2020-02-01 09:32:53 +00:00
sound Staging / IIO patches for 5.5-rc1 2019-11-27 10:57:52 -08:00
usb staging: most: usb: remove prefix from description tag 2019-04-16 13:25:17 +02:00
video staging: most: block module removal while having active configfs items 2019-11-11 16:41:00 +01:00
configfs.c staging: most: block module removal while having active configfs items 2019-11-11 16:41:00 +01:00
core.c staging: most: core: remove sysfs attr remove_link 2019-11-20 15:21:49 +01:00
core.h staging: most: block module removal while having active configfs items 2019-11-11 16:41:00 +01:00
Kconfig staging: most: Fix Kconfig indentation 2019-11-20 15:20:29 +01:00
Makefile staging: most: enable configfs support 2019-04-16 13:25:17 +02:00
TODO Staging: most: add MOST driver's core module 2015-07-24 13:47:32 -07:00