summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMaxim Korotkov <korotkov.maxim.s@gmail.com>2022-11-22 15:29:01 +0300
committerJakub Kicinski <kuba@kernel.org>2022-11-24 07:03:51 +0300
commit64a8f8f7127da228d59a39e2c5e75f86590f90b4 (patch)
treec917c726746d4b2ce0d7f63f0b58d5bf5ceb9c53
parent2094dbbd82f9ef180385e6466f03c40a98a7dfde (diff)
downloadlinux-64a8f8f7127da228d59a39e2c5e75f86590f90b4.tar.xz
ethtool: avoiding integer overflow in ethtool_phys_id()
The value of an arithmetic expression "n * id.data" is subject to possible overflow due to a failure to cast operands to a larger data type before performing arithmetic. Used macro for multiplication instead operator for avoiding overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Maxim Korotkov <korotkov.maxim.s@gmail.com> Reviewed-by: Alexander Lobakin <alexandr.lobakin@intel.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/r/20221122122901.22294-1-korotkov.maxim.s@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-rw-r--r--net/ethtool/ioctl.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
index 99272a67525c..c2f1a542e6fa 100644
--- a/net/ethtool/ioctl.c
+++ b/net/ethtool/ioctl.c
@@ -2013,7 +2013,8 @@ static int ethtool_phys_id(struct net_device *dev, void __user *useraddr)
} else {
/* Driver expects to be called at twice the frequency in rc */
int n = rc * 2, interval = HZ / n;
- u64 count = n * id.data, i = 0;
+ u64 count = mul_u32_u32(n, id.data);
+ u64 i = 0;
do {
rtnl_lock();