diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2011-12-23 14:57:55 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2011-12-23 14:57:55 -0800 |
| commit | 155d4551bd0ab04367f4ca4e0a229774497da4d8 (patch) | |
| tree | e5ea2f802e778c4ad6e343ea344992a20076dd70 /net/core/net-sysfs.c | |
| parent | ad1fca2003822ff2f24c88ad68a29970c5e0d0a7 (diff) | |
| parent | 6350323ad8def2ac00d77cdee3b79c9b9fba75c4 (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
netfilter: xt_connbytes: handle negation correctly
net: relax rcvbuf limits
rps: fix insufficient bounds checking in store_rps_dev_flow_table_cnt()
net: introduce DST_NOPEER dst flag
mqprio: Avoid panic if no options are provided
bridge: provide a mtu() method for fake_dst_ops
Diffstat (limited to 'net/core/net-sysfs.c')
| -rw-r--r-- | net/core/net-sysfs.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index c71c434a4c0..385aefe5364 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -665,11 +665,14 @@ static ssize_t store_rps_dev_flow_table_cnt(struct netdev_rx_queue *queue, if (count) { int i; - if (count > 1<<30) { + if (count > INT_MAX) + return -EINVAL; + count = roundup_pow_of_two(count); + if (count > (ULONG_MAX - sizeof(struct rps_dev_flow_table)) + / sizeof(struct rps_dev_flow)) { /* Enforce a limit to prevent overflow */ return -EINVAL; } - count = roundup_pow_of_two(count); table = vmalloc(RPS_DEV_FLOW_TABLE_SIZE(count)); if (!table) return -ENOMEM; |