Patch "rds: fix an integer overflow test in rds_info_getsockopt()" has been added to the 3.10-stable tree

This is a note to let you know that I've just added the patch titled

rds: fix an integer overflow test in rds_info_getsockopt()

to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
rds-fix-an-integer-overflow-test-in-rds_info_getsockopt.patch
and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Dan Carpenter <[email protected]>
Date: Sat, 1 Aug 2015 15:33:26 +0300
Subject: rds: fix an integer overflow test in rds_info_getsockopt()

From: Dan Carpenter <[email protected]>

[ Upstream commit 468b732b6f76b138c0926eadf38ac88467dcd271 ]

"len" is a signed integer. We check that len is not negative, so it goes from zero to INT_MAX. PAGE_SIZE is unsigned long so the comparison is type promoted to unsigned long. ULONG_MAX - 4095 is a higher than INT_MAX so the condition can never be true.

I don't know if this is harmful but it seems safe to limit "len" to INT_MAX - 4095.

---
 net/rds/info.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *s
 
 	/* check for all kinds of wrapping and the like */
 	start = (unsigned long)optval;
-	if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
+	if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
 		ret = -EINVAL;
 		goto out;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-3.10/vhost-scsi-potential-memory-corruption.patch queue-3.10/rds-fix-an-integer-overflow-test-in-rds_info_getsockopt.patch