net/packet: fix overflow in check for tp_reserve
authorAndrey Konovalov <andreyknvl@google.com>
Wed, 29 Mar 2017 14:11:22 +0000 (16:11 +0200)
committerBen Hutchings <ben@decadent.org.uk>
Mon, 5 Jun 2017 20:13:54 +0000 (21:13 +0100)
commit96053b293c69c636d8d34fc569ac81fbf1118658
tree61ca55850751bfa028902dddedcb31ebe190bbe9
parent1634172286550a62d8a0a98cf8bec5cd975fa09c
net/packet: fix overflow in check for tp_reserve

commit bcc5364bdcfe131e6379363f089e7b4108d35b70 upstream.

When calculating po->tp_hdrlen + po->tp_reserve the result can overflow.

Fix by checking that tp_reserve <= INT_MAX on assign.

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
net/packet/af_packet.c