Dan Carpenter 7cd1033116 rds: fix an integer overflow test in rds_info_getsockopt() ...

[ Upstream commit 468b732b6f ]

"len" is a signed integer.  We check that len is not negative, so it
goes from zero to INT_MAX.  PAGE_SIZE is unsigned long so the comparison
is type promoted to unsigned long.  ULONG_MAX - 4095 is a higher than
INT_MAX so the condition can never be true.

I don't know if this is harmful but it seems safe to limit "len" to
INT_MAX - 4095.

Fixes: a8c879a7ee ('RDS: Info and stats')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2015-10-01 12:07:37 +02:00

..

af_rds.c

rds: Make rds_sock_lock BH rather than IRQ safe.

2012-01-24 17:03:44 -05:00

bind.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

cong.c

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31 19:30:30 -04:00

connection.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

ib_cm.c

IB/rds: suppress incompatible protocol when version is known

2012-12-26 15:17:37 -08:00

ib_rdma.c

rds: rds_ib_device.refcount overflow

2015-08-10 12:20:31 -07:00

ib_recv.c

net: rds: fix per-cpu helper usage

2014-02-06 11:08:16 -08:00

ib_ring.c

RDS/IW+IB: Set recv ring low water mark to 1/2 full.

2009-04-09 17:21:14 -07:00

ib_send.c

rds: prevent BUG_ON triggered on congestion update to loopback

2014-01-15 15:28:45 -08:00

ib_stats.c

RDS: Move atomic stats from general to ib-specific area

2010-09-08 18:12:20 -07:00

ib_sysctl.c

net: Convert all sysctl registrations to register_net_sysctl

2012-04-20 21:22:30 -04:00

ib.c

rds: prevent dereference of a NULL device

2014-01-15 15:28:49 -08:00

ib.h

net: rds: use this_cpu_* per-cpu helper

2012-11-19 18:59:44 -05:00

info.c

rds: fix an integer overflow test in rds_info_getsockopt()

2015-10-01 12:07:37 +02:00

info.h

RDS: Info and stats

2009-02-26 23:39:25 -08:00

iw_cm.c

RDS: use gfp flags from caller in conn_alloc()

2012-03-22 19:29:58 -04:00

iw_rdma.c

rds: avoid potential stack overflow

2015-03-26 15:00:55 +01:00

iw_recv.c

Merge branch 'kmap_atomic' of git://github.com/congwang/linux

2012-03-21 09:40:26 -07:00

iw_ring.c

RDS/IW+IB: Set recv ring low water mark to 1/2 full.

2009-04-09 17:21:14 -07:00

iw_send.c

net/rds: use prink_ratelimited() instead of printk_ratelimit()

2011-06-17 00:03:03 -04:00

iw_stats.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu

2009-09-15 09:39:44 -07:00

iw_sysctl.c

net: Convert all sysctl registrations to register_net_sysctl

2012-04-20 21:22:30 -04:00

iw.c

rds: prevent dereference of a NULL device in rds_iw_laddr_check

2014-04-14 06:42:18 -07:00

iw.h

net: remove interrupt.h inclusion from netdevice.h

2011-06-06 22:55:11 -07:00

Kconfig

net/rds: remove depends on CONFIG_EXPERIMENTAL

2013-01-11 11:40:02 -08:00

loop.c

RDS: use gfp flags from caller in conn_alloc()

2012-03-22 19:29:58 -04:00

loop.h

RDS: loopback

2009-02-26 23:39:26 -08:00

Makefile

Net: rds: Makefile: Remove deprecated items

2010-11-22 08:16:15 -08:00

message.c

rds: simplify a warning message

2013-03-04 14:12:07 -05:00

page.c

net: Fix (nearly-)kernel-doc comments for various functions

2012-07-10 23:13:45 -07:00

rdma_transport.c

net: Fix files explicitly needing to include module.h

2011-10-31 19:30:28 -04:00

rdma_transport.h

rds: make local functions/variables static

2010-10-21 04:26:39 -07:00

rdma.c

rds: Integer overflow in RDS cmsg handling

2010-11-17 12:20:52 -08:00

rds.h

rds: remove the second argument of k[un]map_atomic()

2012-03-20 21:48:28 +08:00

recv.c

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

send.c

RDS: fix rds-ping spinlock recursion

2012-10-09 13:57:23 -04:00

stats.c

net/rds: zero last byte for strncpy

2013-03-08 00:35:44 -05:00

sysctl.c

net: rds: use correct size for max unacked packets and bytes

2015-04-19 10:10:50 +02:00

tcp_connect.c

rds: Don't disable BH on BH context

2012-08-22 22:52:04 -07:00

tcp_listen.c

rds: Don't disable BH on BH context

2012-08-22 22:52:04 -07:00

tcp_recv.c

rds: Don't disable BH on BH context

2012-08-22 22:52:04 -07:00

tcp_send.c

rds: Don't disable BH on BH context

2012-08-22 22:52:04 -07:00

tcp_stats.c

net: rds: fix const array syntax

2011-07-01 16:16:19 -07:00

tcp.c

net: Fix files explicitly needing to include module.h

2011-10-31 19:30:28 -04:00

tcp.h

rds: make local functions/variables static

2010-10-21 04:26:39 -07:00

threads.c

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31 19:30:30 -04:00

transport.c

RDS: have sockets get transport module references

2010-09-08 18:16:47 -07:00