ZhangXiaoxu 34f02c1dd2 ipvs: Fix signed integer overflow when setsockopt timeout ... [ Upstream commit 53ab60baa1 ] There is a UBSAN bug report as below: UBSAN: Undefined behaviour in net/netfilter/ipvs/ip_vs_ctl.c:2227:21 signed integer overflow: -2147483647 * 1000 cannot be represented in type 'int' Reproduce program: #include <stdio.h> #include <sys/types.h> #include <sys/socket.h> #define IPPROTO_IP 0 #define IPPROTO_RAW 255 #define IP_VS_BASE_CTL (64+1024+64) #define IP_VS_SO_SET_TIMEOUT (IP_VS_BASE_CTL+10) /* The argument to IP_VS_SO_GET_TIMEOUT */ struct ipvs_timeout_t { int tcp_timeout; int tcp_fin_timeout; int udp_timeout; }; int main() { int ret = -1; int sockfd = -1; struct ipvs_timeout_t to; sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); if (sockfd == -1) { printf("socket init error\n"); return -1; } to.tcp_timeout = -2147483647; to.tcp_fin_timeout = -2147483647; to.udp_timeout = -2147483647; ret = setsockopt(sockfd, IPPROTO_IP, IP_VS_SO_SET_TIMEOUT, (char *)(&to), sizeof(to)); printf("setsockopt return %d\n", ret); return ret; } Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'. Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com> Acked-by: Simon Horman <horms@verge.net.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-03-13 14:03:12 -07:00
..
6lowpan	6lowpan: iphc: reset mac_header after decompress to fix panic	2018-10-03 17:00:47 -07:00
9p	9p/net: put a lower bound on msize	2019-01-13 10:01:06 +01:00
802	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
8021q	net: fix use-after-free in GRO with ESP	2018-07-22 14:28:44 +02:00
appletalk	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
atm	atm: Preserve value of skb->truesize when accounting to vcc	2018-07-22 14:28:43 +02:00
ax25	ax25: fix possible use-after-free	2019-02-23 09:06:44 +01:00
batman-adv	batman-adv: fix uninit-value in batadv_interface_tx()	2019-02-27 10:08:06 +01:00
bluetooth	Bluetooth: Fix locking in bt_accept_enqueue() for BH context	2019-03-13 14:03:10 -07:00
bpf
bridge	Revert "bridge: do not add port to router list when receives query with source 0.0.0.0"	2019-02-27 10:08:08 +01:00
caif	net: caif: Add a missing rcu_read_unlock() in caif_flow_cb	2018-09-05 09:26:27 +02:00
can	can: bcm: check timer values before ktime conversion	2019-01-31 08:13:46 +01:00
ceph	libceph: handle an empty authorize reply	2019-02-27 10:08:01 +01:00
core	net-sysfs: Fix mem leak in netdev_register_kobject	2019-03-13 14:03:07 -07:00
dcb	net: dcb: For wild-card lookups, use priority -1, not 0	2018-09-19 22:43:43 +02:00
dccp	dccp: fool proof ccid_hc_[rt]x_parse_options()	2019-02-12 19:46:10 +01:00
decnet	dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock	2018-02-25 11:07:52 +01:00
dns_resolver	KEYS: DNS: fix parsing multiple options	2018-07-22 14:28:49 +02:00
dsa	net: dsa: slave: Don't propagate flag changes on down slave interfaces	2019-02-12 19:46:11 +01:00
ethernet
hsr	net/hsr: Check skb_put_padto() return value	2017-08-22 13:40:23 -07:00
ieee802154	ieee802154: lowpan_header_create check must check daddr	2019-01-09 17:14:43 +01:00
ife	net: sched: ife: check on metadata length	2018-04-29 11:33:13 +02:00
ipv4	vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel	2019-03-13 14:03:11 -07:00
ipv6	ipv6: Return error for RTA_VIA attribute	2019-03-13 14:03:09 -07:00
ipx	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
iucv	net/iucv: Free memory obtained by kzalloc	2018-03-31 18:10:41 +02:00
kcm	kcm: Fix use-after-free caused by clonned sockets	2018-06-11 22:49:19 +02:00
key	af_key: Always verify length of provided sadb_key	2018-06-16 09:45:14 +02:00
l2tp	l2tp: fix reading optional fields of L2TPv3	2019-02-06 17:31:33 +01:00
l3mdev
lapb
llc	llc: do not use sk_eat_skb()	2018-12-01 09:42:51 +01:00
mac80211	mac80211: Add attribute aligned(2) to struct 'action'	2019-03-05 17:58:02 +01:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-09-09 19:55:52 +02:00
mpls	mpls: Return error for RTA_GATEWAY attribute	2019-03-13 14:03:09 -07:00
ncsi	net/ncsi: Fix length of GVI response packet	2017-10-21 01:56:38 +01:00
netfilter	ipvs: Fix signed integer overflow when setsockopt timeout	2019-03-13 14:03:12 -07:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-03-13 14:03:08 -07:00
netlink	netlink: Don't shift on 64 for ngroups	2018-08-09 12:16:38 +02:00
netrom	netrom: switch to sock timer API	2019-02-06 17:31:32 +01:00
nfc	net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails	2019-03-13 14:03:08 -07:00
nsh	nsh: set mac len based on inner packet	2018-07-22 14:28:49 +02:00
openvswitch	openvswitch: Avoid OOB read when parsing flow nlattrs	2019-01-31 08:13:41 +01:00
packet	net/packet: fix 4gb buffer limit due to overflow check	2019-02-27 10:08:06 +01:00
phonet	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
psample	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
qrtr	net: qrtr: Broadcast messages only from control port	2018-08-24 13:09:13 +02:00
rds	rds: fix refcount bug in rds_sock_addref	2019-02-12 19:46:10 +01:00
rfkill	rfkill: gpio: fix memory leak in probe error path	2018-05-16 10:10:26 +02:00
rose	net/rose: fix NULL ax25_cb kernel panic	2019-02-06 17:31:32 +01:00
rxrpc	rxrpc: bad unlock balance in rxrpc_recvmsg	2019-02-12 19:46:10 +01:00
sched	net: netem: fix skb length BUG_ON in __skb_to_sgvec	2019-03-13 14:03:08 -07:00
sctp	inet_diag: fix reporting cgroup classid and fallback to priority	2019-02-27 10:08:07 +01:00
smc	net/smc: fix TCP fallback socket release	2019-01-09 17:14:46 +01:00
strparser	strparser: Remove early eaten to fix full tcp receive buffer stall	2018-07-22 14:28:47 +02:00
sunrpc	sunrpc: fix 4 more call sites that were using stack memory with a scatterlist	2019-02-23 09:06:43 +01:00
switchdev
tipc	tipc: fix RDM/DGRAM connect() regression	2019-03-13 14:03:07 -07:00
tls	net/tls: Fixed return value when tls_complete_pending_work() fails	2018-12-05 19:41:11 +01:00
unix	License cleanup: add SPDX license identifiers to some files	2017-11-02 10:04:46 -07:00
vmw_vsock	vsock: cope with memory allocation failure at socket creation time	2019-02-23 09:06:42 +01:00
wimax	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
wireless	cfg80211: extend range deviation for DMG	2019-03-05 17:58:02 +01:00
x25	net/x25: do not hold the cpu too long in x25_new_lci()	2019-02-23 09:06:44 +01:00
xfrm	xfrm: refine validation of template and selector families	2019-02-15 08:09:13 +01:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-09 17:14:46 +01:00
Kconfig	net: Remove CONFIG_NETFILTER_DEBUG and _ASSERT() macros.	2017-09-04 13:25:20 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
socket.c	net: socket: set sock->sk to NULL after calling proto_ops::release()	2019-03-13 14:03:09 -07:00
sysctl_net.c