Skip to content

Commit

Permalink
ethtool: avoiding integer overflow in ethtool_phys_id()
Browse files Browse the repository at this point in the history
The value of an arithmetic expression "n * id.data" is subject
to possible overflow due to a failure to cast operands to a larger data
type before performing arithmetic. Used macro for multiplication instead
operator for avoiding overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Maxim Korotkov <[email protected]>
Reviewed-by: Alexander Lobakin <[email protected]>
Reviewed-by: Andrew Lunn <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
  • Loading branch information
ProjectMutilation authored and kuba-moo committed Nov 24, 2022
1 parent 2094dbb commit 64a8f8f
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion net/ethtool/ioctl.c
Original file line number Diff line number Diff line change
Expand Up @@ -2013,7 +2013,8 @@ static int ethtool_phys_id(struct net_device *dev, void __user *useraddr)
} else {
/* Driver expects to be called at twice the frequency in rc */
int n = rc * 2, interval = HZ / n;
u64 count = n * id.data, i = 0;
u64 count = mul_u32_u32(n, id.data);
u64 i = 0;

do {
rtnl_lock();
Expand Down

0 comments on commit 64a8f8f

Please sign in to comment.