CVS commit: src/sys/net/lagg

[Shoichi YAMAGUCHI]

Module Name:    src
Committed By:   yamaguchi
Date:           Thu Apr  4 08:26:32 UTC 2024

Modified Files:
        src/sys/net/lagg: if_lagg.c

Log Message:
lagg(4): added size check to SIOCSLAGG

pointed out by ozaki-r@, thanks.


To generate a diff of this commit:
cvs rdiff -u -r1.60 -r1.61 src/sys/net/lagg/if_lagg.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/net/lagg/if_lagg.c
diff -u src/sys/net/lagg/if_lagg.c:1.60 src/sys/net/lagg/if_lagg.c:1.61
--- src/sys/net/lagg/if_lagg.c:1.60	Thu Apr  4 08:22:17 2024
+++ src/sys/net/lagg/if_lagg.c	Thu Apr  4 08:26:32 2024
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_lagg.c,v 1.60 2024/04/04 08:22:17 yamaguchi Exp $	*/
+/*	$NetBSD: if_lagg.c,v 1.61 2024/04/04 08:26:32 yamaguchi Exp $	*/
 
 /*
  * Copyright (c) 2005, 2006 Reyk Floeter <r...@openbsd.org>
@@ -20,7 +20,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_lagg.c,v 1.60 2024/04/04 08:22:17 yamaguchi Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_lagg.c,v 1.61 2024/04/04 08:26:32 yamaguchi Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -693,7 +693,10 @@ lagg_ioctl(struct ifnet *ifp, u_long cmd
 			break;
 
 		nports = laggreq.lrq_nports;
-		if (nports > 0) {
+		if (nports > LAGG_MAX_PORTS) {
+			error = ENOMEM;
+			break;
+		} else if (nports > 0) {
 			allocsiz = sizeof(struct lagg_req)
 			    + sizeof(struct laggreqport) * nports;
 			buf = kmem_alloc(allocsiz, KM_SLEEP);