From 1558efd0d48671845d2bd9ad80ba042577afd578 Mon Sep 17 00:00:00 2001 From: Wenliang Fan Date: Wed, 18 Dec 2013 13:56:12 +0800 Subject: [PATCH] drivers/net/wireless/hostap: Integer overflow The local variable 'value' comes from 'extra', a parameter of function 'prism2_ioctl_priv_prism2_param'. If a large number passed to 'value', there would be an integer overflow in the following line: local->passive_scan_timer.expires = jiffies + local->passive_scan_interval * HZ Signed-off-by: Wenliang Fan Signed-off-by: John W. Linville --- drivers/net/wireless/hostap/hostap_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c index e5090309824e..63e350affc7e 100644 --- a/drivers/net/wireless/hostap/hostap_ioctl.c +++ b/drivers/net/wireless/hostap/hostap_ioctl.c @@ -2567,7 +2567,7 @@ static int prism2_ioctl_priv_prism2_param(struct net_device *dev, local->passive_scan_interval = value; if (timer_pending(&local->passive_scan_timer)) del_timer(&local->passive_scan_timer); - if (value > 0) { + if (value > 0 && value < INT_MAX / HZ) { local->passive_scan_timer.expires = jiffies + local->passive_scan_interval * HZ; add_timer(&local->passive_scan_timer); -- 2.20.1