Re: [PATCH net v2] af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Wed, 23 Sep 2026 13:01:01 +0800 you wrote:

prb_calc_retire_blk_tmo() computes in 32-bit int arithmetic:

        mbits = (blk_size_in_bytes * 8) / (1024 * 1024);

If I'm reading the validation right, tp_block_size is user
controlled and packet_set_ring() only rejects values that are <= 0
as int or not page aligned, so a 256MiB block goes right through
(and alloc_one_pg_vec_page() even has a vzalloc fallback for it).
0x10000000 * 8 wraps to INT_MIN, and on a NIC reporting 1 Gbps
(div == 1) the function ends up returning -2047.

[...]

Here is the summary with links:
  - [net,v2] af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
    https://git.kernel.org/netdev/net/c/56d82862a0a2

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html