Andrey Shvetsov b5e5d81230 staging: most: net: fix buffer overflow ... commit 4d1356ac12 upstream. If the length of the socket buffer is 0xFFFFFFFF (max size for an unsigned int), then payload_len becomes 0xFFFFFFF1 after subtracting 14 (ETH_HLEN). Then, mdp_len is set to payload_len + 16 (MDP_HDR_LEN) which overflows and results in a value of 2. These values for payload_len and mdp_len will pass current buffer size checks. This patch checks if derived from skb->len sum may overflow. The check is based on the following idea: For any `unsigned V1, V2` and derived `unsigned SUM = V1 + V2`, `V1 + V2` overflows iif `SUM < V1`. Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Andrey Shvetsov <andrey.shvetsov@k2l.de> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200116172238.6046-1-andrey.shvetsov@microchip.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-02-01 09:34:33 +00:00
..
Kconfig	staging: add missing SPDX lines to Kconfig files	2019-04-03 11:10:15 +02:00
Makefile	staging: add missing SPDX lines to Makefile files	2019-04-03 11:10:15 +02:00
net.c	staging: most: net: fix buffer overflow	2020-02-01 09:34:33 +00:00