D58896.diff
No OneTemporary
Actions

Size

975 B

Referenced Files

None

Subscribers

None

D58896.diff
View Options

	diff --git a/sys/dev/netmap/netmap_mem2.c b/sys/dev/netmap/netmap_mem2.c
	--- a/sys/dev/netmap/netmap_mem2.c
	+++ b/sys/dev/netmap/netmap_mem2.c
	@@ -38,6 +38,7 @@

	#ifdef __FreeBSD__
	#include <sys/types.h>
	+#include <sys/ckdint.h>
	#include <sys/domainset.h>
	#include <sys/limits.h>
	#include <sys/malloc.h>
	@@ -2013,16 +2014,11 @@
	if (netmap_debug & NM_DEBUG_MEM)
	nm_prinf("creating %s", kring->name);
	ndesc = kring->nkr_num_slots;
	- if (ndesc >= UINT_MAX / sizeof(struct netmap_slot)) {
	+ if (ckd_mul(&len, ndesc, sizeof(struct netmap_slot)) \|\|
	+ ckd_add(&len, len, sizeof(struct netmap_ring))) {
	error = EINVAL;
	goto cleanup;
	}
	- len = ndesc * sizeof(struct netmap_slot);
	- if (len + sizeof(struct netmap_ring) < len) {
	- error = EINVAL;
	- goto cleanup;
	- }
	- len += sizeof(struct netmap_ring);
	ring = netmap_ring_malloc(nmd, len);
	if (ring == NULL) {
	nm_prerr("Cannot allocate %s_ring", nm_txrx2str(t));