[src/trunk]: src/sys/net bpf(4): Clamp read timeout to INT_MAX ticks to avoid...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d4cfff5b0ee4
branches:  trunk
changeset: 363436:d4cfff5b0ee4
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sat Mar 12 16:19:08 2022 +0000

description:
bpf(4): Clamp read timeout to INT_MAX ticks to avoid overflow.

Reported-by: syzbot+c543d35064d3492b9091%syzkaller.appspotmail.com@localhost

diffstat:

 sys/net/bpf.c |  18 ++++++++++++++----
 1 files changed, 14 insertions(+), 4 deletions(-)

diffs (46 lines):

diff -r beba27878d62 -r d4cfff5b0ee4 sys/net/bpf.c
--- a/sys/net/bpf.c     Sat Mar 12 16:06:15 2022 +0000
+++ b/sys/net/bpf.c     Sat Mar 12 16:19:08 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: bpf.c,v 1.243 2021/09/26 01:16:10 thorpej Exp $        */
+/*     $NetBSD: bpf.c,v 1.244 2022/03/12 16:19:08 riastradh Exp $      */
 
 /*
  * Copyright (c) 1990, 1991, 1993
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: bpf.c,v 1.243 2021/09/26 01:16:10 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bpf.c,v 1.244 2022/03/12 16:19:08 riastradh Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_bpf.h"
@@ -1152,7 +1152,12 @@
                        struct timeval *tv = addr;
 
                        /* Compute number of ticks. */
-                       d->bd_rtout = tv->tv_sec * hz + tv->tv_usec / tick;
+                       if (tv->tv_sec > INT_MAX/hz - 1) {
+                               d->bd_rtout = INT_MAX;
+                       } else {
+                               d->bd_rtout = tv->tv_sec * hz
+                                   + tv->tv_usec / tick;
+                       }
                        if ((d->bd_rtout == 0) && (tv->tv_usec != 0))
                                d->bd_rtout = 1;
                        break;
@@ -1181,7 +1186,12 @@
                        struct timeval50 *tv = addr;
 
                        /* Compute number of ticks. */
-                       d->bd_rtout = tv->tv_sec * hz + tv->tv_usec / tick;
+                       if (tv->tv_sec > INT_MAX/hz - 1) {
+                               d->bd_rtout = INT_MAX;
+                       } else {
+                               d->bd_rtout = tv->tv_sec * hz
+                                   + tv->tv_usec / tick;
+                       }
                        if ((d->bd_rtout == 0) && (tv->tv_usec != 0))
                                d->bd_rtout = 1;
                        break;