⬢ DragonFlyBSD Kernel Audit
DF-2438 / fix.diff
← back to finding ↓ download raw
# DF-2438 fix (authored post-verification; not applied to sys/)
--- a/sys/dev/disk/dm/delay/dm_target_delay.c
+++ b/sys/dev/disk/dm/delay/dm_target_delay.c
@@ -138,5 +138,9 @@
 	di->pdev = dmp;
 	di->offset = atoi64(argv[1]);
 	tmp = atoi64(argv[2]);
-	di->delay = tmp * hz / 1000;
+	/* compute in 64-bit and reject values that cannot be represented
+	 * as a signed tick count instead of letting int arithmetic wrap */
+	if (tmp < 0 || (tmp * (int64_t)hz) / 1000 > __INT_MAX__)
+		return EINVAL;
+	di->delay = (int)((tmp * (int64_t)hz) / 1000);
 	di->count = 0;