The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d6f5c6531e4848086478961d03f4d13170eff02a
commit d6f5c6531e4848086478961d03f4d13170eff02a Author: Mark Johnston <[email protected]> AuthorDate: 2026-08-27 13:06:20 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-08-27 13:33:10 +0000 netmap: Use ckdint.h helpers to check for overflow This addresses a bug in the addition overflow check added in commit 319414a926af ("netmap: Handle overflow when computing ring sizes"): that overflow wasn't actually caught by the check because "len" is promoted to size_t. PR: 297300 Fixes: 319414a926af ("netmap: Handle overflow when computing ring sizes") Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58896 --- sys/dev/netmap/netmap_mem2.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/sys/dev/netmap/netmap_mem2.c b/sys/dev/netmap/netmap_mem2.c index 2d77acbbb06c..21a7c0900fcf 100644 --- a/sys/dev/netmap/netmap_mem2.c +++ b/sys/dev/netmap/netmap_mem2.c @@ -38,6 +38,7 @@ #ifdef __FreeBSD__ #include <sys/types.h> +#include <sys/ckdint.h> #include <sys/domainset.h> #include <sys/limits.h> #include <sys/malloc.h> @@ -2013,16 +2014,11 @@ netmap_mem2_rings_create(struct netmap_mem_d *nmd, struct netmap_adapter *na) if (netmap_debug & NM_DEBUG_MEM) nm_prinf("creating %s", kring->name); ndesc = kring->nkr_num_slots; - if (ndesc >= UINT_MAX / sizeof(struct netmap_slot)) { + if (ckd_mul(&len, ndesc, sizeof(struct netmap_slot)) || + ckd_add(&len, len, sizeof(struct netmap_ring))) { error = EINVAL; goto cleanup; } - len = ndesc * sizeof(struct netmap_slot); - if (len + sizeof(struct netmap_ring) < len) { - error = EINVAL; - goto cleanup; - } - len += sizeof(struct netmap_ring); ring = netmap_ring_malloc(nmd, len); if (ring == NULL) { nm_prerr("Cannot allocate %s_ring", nm_txrx2str(t));
