diff options
| author | Elena Salomatkina <esalomatkina@ispras.ru> | 2024-10-13 15:45:29 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-12-14 19:54:40 +0100 |
| commit | a478f3841e6c2f17f4ede2c2bcf44864381f8bac (patch) | |
| tree | 615f01e34e903f8fc56d43b9c70ef8fd7b7a0866 /net/sched | |
| parent | 9c3d8ed72812449b70f0218e2612ce221d2179fd (diff) | |
| download | linux-a478f3841e6c2f17f4ede2c2bcf44864381f8bac.tar.gz linux-a478f3841e6c2f17f4ede2c2bcf44864381f8bac.tar.bz2 linux-a478f3841e6c2f17f4ede2c2bcf44864381f8bac.zip | |
net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
[ Upstream commit 397006ba5d918f9b74e734867e8fddbc36dc2282 ]
The subsequent calculation of port_rate = speed * 1000 * BYTES_PER_KBIT,
where the BYTES_PER_KBIT is of type LL, may cause an overflow.
At least when speed = SPEED_20000, the expression to the left of port_rate
will be greater than INT_MAX.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Elena Salomatkina <esalomatkina@ispras.ru>
Link: https://patch.msgid.link/20241013124529.1043-1-esalomatkina@ispras.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/sch_cbs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c index cac870eb7897..0567a15d0f85 100644 --- a/net/sched/sch_cbs.c +++ b/net/sched/sch_cbs.c @@ -310,7 +310,7 @@ static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q) { struct ethtool_link_ksettings ecmd; int speed = SPEED_10; - int port_rate; + s64 port_rate; int err; err = __ethtool_get_link_ksettings(dev, &ecmd); |