git: d6f5c6531e48 - main - netmap: Use ckdint.h helpers to check for overflow

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=d6f5c6531e4848086478961d03f4d13170eff02a

commit d6f5c6531e4848086478961d03f4d13170eff02a
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-08-27 13:06:20 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-08-27 13:33:10 +0000

    netmap: Use ckdint.h helpers to check for overflow
    
    This addresses a bug in the addition overflow check added in commit
    319414a926af ("netmap: Handle overflow when computing ring sizes"): that
    overflow wasn't actually caught by the check because "len" is promoted
    to size_t.
    
    PR:             297300
    Fixes:          319414a926af ("netmap: Handle overflow when computing ring sizes")
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58896
---
 sys/dev/netmap/netmap_mem2.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/sys/dev/netmap/netmap_mem2.c b/sys/dev/netmap/netmap_mem2.c
index 2d77acbbb06c..21a7c0900fcf 100644
--- a/sys/dev/netmap/netmap_mem2.c
+++ b/sys/dev/netmap/netmap_mem2.c
@@ -38,6 +38,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/types.h>
+#include <sys/ckdint.h>
 #include <sys/domainset.h>
 #include <sys/limits.h>
 #include <sys/malloc.h>
@@ -2013,16 +2014,11 @@ netmap_mem2_rings_create(struct netmap_mem_d *nmd, struct netmap_adapter *na)
 			if (netmap_debug & NM_DEBUG_MEM)
 				nm_prinf("creating %s", kring->name);
 			ndesc = kring->nkr_num_slots;
-			if (ndesc >= UINT_MAX / sizeof(struct netmap_slot)) {
+			if (ckd_mul(&len, ndesc, sizeof(struct netmap_slot)) ||
+			    ckd_add(&len, len, sizeof(struct netmap_ring))) {
 				error = EINVAL;
 				goto cleanup;
 			}
-			len = ndesc * sizeof(struct netmap_slot);
-			if (len + sizeof(struct netmap_ring) < len) {
-				error = EINVAL;
-				goto cleanup;
-			}
-			len += sizeof(struct netmap_ring);
 			ring = netmap_ring_malloc(nmd, len);
 			if (ring == NULL) {
 				nm_prerr("Cannot allocate %s_ring", nm_txrx2str(t));