* [PATCH net] net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
@ 2024-10-13 12:45 Elena Salomatkina
2024-10-16 1:30 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 2+ messages in thread
From: Elena Salomatkina @ 2024-10-13 12:45 UTC (permalink / raw)
To: Jamal Hadi Salim
Cc: Elena Salomatkina, Cong Wang, Jiri Pirko, David S. Miller,
Jakub Kicinski, Leandro Dorileo, Vedang Patel, netdev,
linux-kernel, lvc-project
The subsequent calculation of port_rate = speed * 1000 * BYTES_PER_KBIT,
where the BYTES_PER_KBIT is of type LL, may cause an overflow.
At least when speed = SPEED_20000, the expression to the left of port_rate
will be greater than INT_MAX.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: e0a7683d30e9 ("net/sched: cbs: fix port_rate miscalculation")
Signed-off-by: Elena Salomatkina <esalomatkina@ispras.ru>
---
net/sched/sch_cbs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index 2eaac2ff380f..db92ae819fd2 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -309,7 +309,7 @@ static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
{
struct ethtool_link_ksettings ecmd;
int speed = SPEED_10;
- int port_rate;
+ s64 port_rate;
int err;
err = __ethtool_get_link_ksettings(dev, &ecmd);
--
2.33.0
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH net] net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
2024-10-13 12:45 [PATCH net] net/sched: cbs: Fix integer overflow in cbs_set_port_rate() Elena Salomatkina
@ 2024-10-16 1:30 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 2+ messages in thread
From: patchwork-bot+netdevbpf @ 2024-10-16 1:30 UTC (permalink / raw)
To: Elena Salomatkina
Cc: jhs, xiyou.wangcong, jiri, davem, kuba, leandro.maciel.dorileo,
vedang.patel, netdev, linux-kernel, lvc-project
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Sun, 13 Oct 2024 15:45:29 +0300 you wrote:
> The subsequent calculation of port_rate = speed * 1000 * BYTES_PER_KBIT,
> where the BYTES_PER_KBIT is of type LL, may cause an overflow.
> At least when speed = SPEED_20000, the expression to the left of port_rate
> will be greater than INT_MAX.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> [...]
Here is the summary with links:
- [net] net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
https://git.kernel.org/netdev/net-next/c/397006ba5d91
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-10-16 1:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-10-13 12:45 [PATCH net] net/sched: cbs: Fix integer overflow in cbs_set_port_rate() Elena Salomatkina
2024-10-16 1:30 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome