From 43ab85021e8286e1641928ab3cc542dd1e8c7f94 Mon Sep 17 00:00:00 2001 From: roel kluin Date: Wed, 14 Oct 2009 05:26:30 +0000 Subject: [PATCH] ax25: unsigned cannot be less than 0 in ax25_ctl_ioctl() struct ax25_ctl_struct member `arg' is unsigned and cannot be less than 0. Signed-off-by: Roel Kluin Signed-off-by: David S. Miller --- net/ax25/af_ax25.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index f05306f168fa..f1e998b2796e 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -369,6 +369,9 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) if (ax25_ctl.digi_count > AX25_MAX_DIGIS) return -EINVAL; + if (ax25_ctl.arg > ULONG_MAX / HZ && ax25_ctl.cmd != AX25_KILL) + return -EINVAL; + digi.ndigi = ax25_ctl.digi_count; for (k = 0; k < digi.ndigi; k++) digi.calls[k] = ax25_ctl.digi_addr[k]; @@ -418,14 +421,10 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) break; case AX25_T3: - if (ax25_ctl.arg < 0) - goto einval_put; ax25->t3 = ax25_ctl.arg * HZ; break; case AX25_IDLE: - if (ax25_ctl.arg < 0) - goto einval_put; ax25->idle = ax25_ctl.arg * 60 * HZ; break; -- 2.20.1