| From 801b4d9ad5761d229cbccf162639b5294705458b Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 16 Feb 2026 14:28:28 +0000 |
| Subject: icmp: prevent possible overflow in icmp_global_allow() |
| |
| From: Eric Dumazet <edumazet@google.com> |
| |
| [ Upstream commit 034bbd806298e9ba4197dd1587b0348ee30996ea ] |
| |
| Following expression can overflow |
| if sysctl_icmp_msgs_per_sec is big enough. |
| |
| sysctl_icmp_msgs_per_sec * delta / HZ; |
| |
| Fixes: 4cdf507d5452 ("icmp: add a global rate limitation") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> |
| Link: https://patch.msgid.link/20260216142832.3834174-2-edumazet@google.com |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/ipv4/icmp.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c |
| index a2cff16668d72..471dd862f6639 100644 |
| --- a/net/ipv4/icmp.c |
| +++ b/net/ipv4/icmp.c |
| @@ -248,7 +248,8 @@ bool icmp_global_allow(struct net *net) |
| if (delta < HZ / 50) |
| return false; |
| |
| - incr = READ_ONCE(net->ipv4.sysctl_icmp_msgs_per_sec) * delta / HZ; |
| + incr = READ_ONCE(net->ipv4.sysctl_icmp_msgs_per_sec); |
| + incr = div_u64((u64)incr * delta, HZ); |
| if (!incr) |
| return false; |
| |
| -- |
| 2.51.0 |
| |
