diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-08-07 14:47:13 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-08-07 16:30:24 +0000 |
| commit | 319414a926af1515e2572f89f0636e5505e762d5 (patch) | |
| tree | e0e4a31288fe9a0bdd906762f48f50178b7da0f2 | |
| parent | 6de818285f066c6705816674c671761dc09bff90 (diff) | |
netmap: Handle overflow when computing ring sizes
PR: 297300
Reported by: Robert Morris
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58678
| -rw-r--r-- | sys/dev/netmap/netmap_mem2.c | 22 |
1 files changed, 18 insertions, 4 deletions
diff --git a/sys/dev/netmap/netmap_mem2.c b/sys/dev/netmap/netmap_mem2.c index 865a663da364..2d77acbbb06c 100644 --- a/sys/dev/netmap/netmap_mem2.c +++ b/sys/dev/netmap/netmap_mem2.c @@ -39,6 +39,7 @@ #ifdef __FreeBSD__ #include <sys/types.h> #include <sys/domainset.h> +#include <sys/limits.h> #include <sys/malloc.h> #include <sys/kernel.h> /* MALLOC_DEFINE */ #include <sys/proc.h> @@ -1992,6 +1993,7 @@ static int netmap_mem2_rings_create(struct netmap_mem_d *nmd, struct netmap_adapter *na) { enum txrx t; + int error; for_rx_tx(t) { u_int i; @@ -2011,11 +2013,20 @@ netmap_mem2_rings_create(struct netmap_mem_d *nmd, struct netmap_adapter *na) if (netmap_debug & NM_DEBUG_MEM) nm_prinf("creating %s", kring->name); ndesc = kring->nkr_num_slots; - len = sizeof(struct netmap_ring) + - ndesc * sizeof(struct netmap_slot); + if (ndesc >= UINT_MAX / sizeof(struct netmap_slot)) { + error = EINVAL; + goto cleanup; + } + len = ndesc * sizeof(struct netmap_slot); + if (len + sizeof(struct netmap_ring) < len) { + error = EINVAL; + goto cleanup; + } + len += sizeof(struct netmap_ring); ring = netmap_ring_malloc(nmd, len); if (ring == NULL) { nm_prerr("Cannot allocate %s_ring", nm_txrx2str(t)); + error = ENOMEM; goto cleanup; } nm_prdis("txring at %p", ring); @@ -2040,7 +2051,10 @@ netmap_mem2_rings_create(struct netmap_mem_d *nmd, struct netmap_adapter *na) if (netmap_debug & NM_DEBUG_MEM) nm_prinf("allocating buffers for %s", kring->name); if (netmap_new_bufs(nmd, ring->slot, ndesc)) { - nm_prerr("Cannot allocate buffers for %s_ring", nm_txrx2str(t)); + nm_prerr( + "Cannot allocate buffers for %s_ring", + nm_txrx2str(t)); + error = ENOMEM; goto cleanup; } } else { @@ -2064,7 +2078,7 @@ cleanup: * to do the cleanup */ - return ENOMEM; + return error; } static void |