net: neighbour: prohibit negative value for unres_qlen_bytes parameter

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / core / neighbour.c

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f1c0c2e9cad5fd860e367b5bc63716714b14df79..36fc692e2bdea89f63395f5b5732e5a239d095b9 100644 (file)
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -62,6 +62,9 @@ static void __neigh_notify(struct neighbour *n, int type, int flags);
 static void neigh_update_notify(struct neighbour *neigh);
 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
 
+static int zero;
+static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
+
 static struct neigh_table *neigh_tables;
 #ifdef CONFIG_PROC_FS
 static const struct file_operations neigh_stat_seq_fops;
@@ -1787,8 +1790,7 @@ static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
            nla_put_u32(skb, NDTPA_QUEUE_LENBYTES, parms->queue_len_bytes) ||
            /* approximative value for deprecated QUEUE_LEN (in packets) */
            nla_put_u32(skb, NDTPA_QUEUE_LEN,
-                       DIV_ROUND_UP(parms->queue_len_bytes,
-                                    SKB_TRUESIZE(ETH_FRAME_LEN))) ||
+                       parms->queue_len_bytes / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
            nla_put_u32(skb, NDTPA_PROXY_QLEN, parms->proxy_qlen) ||
            nla_put_u32(skb, NDTPA_APP_PROBES, parms->app_probes) ||
            nla_put_u32(skb, NDTPA_UCAST_PROBES, parms->ucast_probes) ||
@@ -2777,9 +2779,13 @@ static int proc_unres_qlen(ctl_table *ctl, int write, void __user *buffer,
        int size, ret;
        ctl_table tmp = *ctl;
 
+       tmp.extra1 = &zero;
+       tmp.extra2 = &unres_qlen_max;
        tmp.data = &size;
-       size = DIV_ROUND_UP(*(int *)ctl->data, SKB_TRUESIZE(ETH_FRAME_LEN));
-       ret = proc_dointvec(&tmp, write, buffer, lenp, ppos);
+
+       size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
+       ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
+
        if (write && !ret)
                *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
        return ret;
@@ -2865,7 +2871,8 @@ static struct neigh_sysctl_table {
                        .procname       = "unres_qlen_bytes",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                       .proc_handler   = proc_dointvec,
+                       .extra1         = &zero,
+                       .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_PROXY_QLEN] = {
                        .procname       = "proxy_qlen",