Commit 80b78c39 authored by Dan Carpenter's avatar Dan Carpenter Committed by Pablo Neira Ayuso
Browse files

ipvs: prevent integer overflow in do_ip_vs_get_ctl() 



The get->num_services variable is an unsigned int which is controlled by
the user.  The struct_size() function ensures that the size calculation
does not overflow an unsigned long, however, we are saving the result to
an int so the calculation can overflow.

Both "len" and "get->num_services" come from the user.  This check is
just a sanity check to help the user and ensure they are using the API
correctly.  An integer overflow here is not a big deal.  This has no
security impact.

Save the result from struct_size() type size_t to fix this integer
overflow bug.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c21b02fd

net/netfilter/ipvs/ip_vs_ctl.c

+4 −4
Original line number Diff line number Diff line
@@ -3091,12 +3091,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 
	case IP_VS_SO_GET_SERVICES:

	{

		struct ip_vs_get_services *get;

		int size;

		size_t size;



		get = (struct ip_vs_get_services *)arg;

		size = struct_size(get, entrytable, get->num_services);

		if (*len != size) {

			pr_err("length: %u != %u\n", *len, size);

			pr_err("length: %u != %zu\n", *len, size);

			ret = -EINVAL;

			goto out;

		}
@@ -3132,12 +3132,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 
	case IP_VS_SO_GET_DESTS:

	{

		struct ip_vs_get_dests *get;

		int size;

		size_t size;



		get = (struct ip_vs_get_dests *)arg;

		size = struct_size(get, entrytable, get->num_dests);

		if (*len != size) {

			pr_err("length: %u != %u\n", *len, size);

			pr_err("length: %u != %zu\n", *len, size);

			ret = -EINVAL;

			goto out;

		}