[PATCH AUTOSEL 5.15 09/36] net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
flat view
DORMANTno replies
From: Sasha Levin <sashal@kernel.org>
Date: 2024-11-24 13:52:37
Also in:
lkml, stable
Subsystem:
cbs/etf/taprio qdiscs, networking [general], tc subsystem, the rest · Maintainers:
Vinicius Costa Gomes, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Jamal Hadi Salim, Jiri Pirko, Linus Torvalds
From: Elena Salomatkina <redacted> [ Upstream commit 397006ba5d918f9b74e734867e8fddbc36dc2282 ] The subsequent calculation of port_rate = speed * 1000 * BYTES_PER_KBIT, where the BYTES_PER_KBIT is of type LL, may cause an overflow. At least when speed = SPEED_20000, the expression to the left of port_rate will be greater than INT_MAX. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Elena Salomatkina <redacted> Link: https://patch.msgid.link/20241013124529.1043-1-esalomatkina@ispras.ru (local) Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- net/sched/sch_cbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index 459cc240eda9c..e0ced550808a5 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c@@ -310,7 +310,7 @@ static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q) { struct ethtool_link_ksettings ecmd; int speed = SPEED_10; - int port_rate; + s64 port_rate; int err; err = __ethtool_get_link_ksettings(dev, &ecmd);
--
2.43.0