drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()
authorWenliang Fan <fanwlexca@gmail.com>
Tue, 17 Dec 2013 03:25:28 +0000 (11:25 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Jan 2014 23:27:11 +0000 (15:27 -0800)
commitb7e3762c40e1d7f7a147f7d5be9584e1603bea01
treeef3c6b3dd404c7d6cb7178efc0e923a717cbd30b
parent931a701d92ac7449efc5bb7e579f377f5eb565fd
drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()

[ Upstream commit e9db5c21d3646a6454fcd04938dd215ac3ab620a ]

The local variable 'bi' comes from userspace. If userspace passed a
large number to 'bi.data.calibrate', there would be an integer overflow
in the following line:
s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;

Signed-off-by: Wenliang Fan <fanwlexca@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/hamradio/hdlcdrv.c