linux-kernel - [PATCH] ipvs:set sock send/receive buffer correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 17 Apr 2019 17:18:17 +0800
From:   linmiaohe <linmiaohe@...wei.com>
To:     <wensong@...ux-vs.org>, <horms@...ge.net.au>, <ja@....bg>,
        <pablo@...filter.org>, <kadlec@...ckhole.kfki.hu>, <fw@...len.de>,
        <davem@...emloft.net>, <netdev@...r.kernel.org>,
        <lvs-devel@...r.kernel.org>, <netfilter-devel@...r.kernel.org>,
        <coreteam@...filter.org>, <linux-kernel@...r.kernel.org>
CC:     Mingfangsen <mingfangsen@...wei.com>, <liujie165@...wei.com>,
        <linmiaohe@...wei.com>
Subject: [PATCH] ipvs:set sock send/receive buffer correctly

From: Jie Liu <liujie165@...wei.com>

If we set sysctl_wmem_max or sysctl_rmem_max larger than INT_MAX,
the send/receive buffer of sock will be an negative value. Same as
when the val is larger than INT_MAX/2.

Fixes: 1c003b1580e2 ("ipvs: wakeup master thread")
Reported-by: Qiang Ning <ningqiang1@...wei.com>
Reviewed-by: Miaohe Lin <linmiaohe@...wei.com>
Signed-off-by: Jie Liu <liujie165@...wei.com>
---
 net/netfilter/ipvs/ip_vs_sync.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 2526be6b3d90..c0e4cbed6e74 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1278,14 +1278,12 @@ static void set_sock_size(struct sock *sk, int mode, int val)
 	/* setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &val, sizeof(val)); */
 	lock_sock(sk);
 	if (mode) {
-		val = clamp_t(int, val, (SOCK_MIN_SNDBUF + 1) / 2,
-			      sysctl_wmem_max);
-		sk->sk_sndbuf = val * 2;
+		val = min_t(u32, val, sysctl_wmem_max);
+		sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
 		sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
 	} else {
-		val = clamp_t(int, val, (SOCK_MIN_RCVBUF + 1) / 2,
-			      sysctl_rmem_max);
-		sk->sk_rcvbuf = val * 2;
+		val = min_t(u32, val, sysctl_rmem_max);
+		sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
 		sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
 	}
 	release_sock(sk);
-- 
2.19.1