Subject: Re: [Question] integer overflow in function __qdisc_calculate_pkt_len()

From: Jakub Kicinski <[email-masked]>
Date: Tue, 6 Jun 2023 08:49:19 -0700

On Tue, 6 Jun 2023 20:54:47 +0800 luwei (O) wrote:
> > on a quick look limiting the cell_align to S16_MIN at the netlink level
> > (NLA_POLICY_MIN()) seems reasonable, feel free to send a patch.
> > .  
> 
> Thanks for your reply, but do your mean cell_align or overhead? It seems 
> limit cell_align to
> 
> S16_MIN(-32768) can still cause the overflow:
> 
>      66 + (-2147483559) + (-32767) = 2147451036
> 
>    skb->len = 66
>    stab->szopts.overhead = -2147483559
>    stab->szopts.cell_align = -32767

Could you explain what the problem caused by the overflow will be?