From ca4cb9aedd46d4c098c1eea07c59b35c3b1adcb7 Mon Sep 17 00:00:00 2001 From: Chris Wright Date: Mon, 20 Nov 2006 15:02:49 -0800 Subject: [PATCH] --- yaml --- r: 41105 b: refs/heads/master c: ba8379b220509e9448c00a77cf6c15ac2a559cc7 h: refs/heads/master i: 41103: 6edd0dbb507bd59bfaec2d4981e340f745ccf6fb v: v3 --- [refs] | 2 +- trunk/net/bridge/br_ioctl.c | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/[refs] b/[refs] index d051fb550d1e..dc80efa00d1d 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 24d7bb3396c51ceb2285e0e7b0c1bd1865652c43 +refs/heads/master: ba8379b220509e9448c00a77cf6c15ac2a559cc7 diff --git a/trunk/net/bridge/br_ioctl.c b/trunk/net/bridge/br_ioctl.c index 4e4119a12139..4c61a7e0a86e 100644 --- a/trunk/net/bridge/br_ioctl.c +++ b/trunk/net/bridge/br_ioctl.c @@ -58,12 +58,13 @@ static int get_fdb_entries(struct net_bridge *br, void __user *userbuf, { int num; void *buf; - size_t size = maxnum * sizeof(struct __fdb_entry); + size_t size; - if (size > PAGE_SIZE) { - size = PAGE_SIZE; + /* Clamp size to PAGE_SIZE, test maxnum to avoid overflow */ + if (maxnum > PAGE_SIZE/sizeof(struct __fdb_entry)) maxnum = PAGE_SIZE/sizeof(struct __fdb_entry); - } + + size = maxnum * sizeof(struct __fdb_entry); buf = kmalloc(size, GFP_USER); if (!buf)