rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/getUsersByJSON/sort/ and a trailing string.
Vulnerability ID: CVE-2016-9284
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/exponentcms/exponent-cms
Published: 2016-11-11
File: framework/modules/users/controllers/usersController.php
Commit message: fix security vulnerability to get user list, reported by pang0lin
Commit author: dleffler

Vulnerable version (before fix):
 class usersController extends expController {         'update'           => 'Update Users',         'show'             => 'Show User',         'showall'          => 'Show Users',     );      static function displayname() {

Fixed version (after fix):
 class usersController extends expController {         'update'           => 'Update Users',         'show'             => 'Show User',         'showall'          => 'Show Users',         'getUsersByJSON'   => 'Get Users',     );      static function displayname() {

Patch:
patch: @@ -39,6 +39,7 @@ class usersController extends expController {
         'update'           => 'Update Users',
         'show'             => 'Show User',
         'showall'          => 'Show Users',
+        'getUsersByJSON'   => 'Get Users',
     );
 
     static function displayname() {
path: framework/modules/users/controllers/usersController.php
Vulnerability: framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI.
Vulnerability ID: CVE-2016-9286
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/exponentcms/exponent-cms
Published: 2016-11-11
File: framework/modules/users/controllers/usersController.php
Commit message: Prevent logged in uses from view other user records and admins from super-admin records; thanks to pang0lin
Commit author: dleffler

Vulnerable version (before fix):
 static function canImportData() {         return true;     }      public function manage() {         global $user; 

Fixed version (after fix):
 static function canImportData() {         return true;     }      public function show() {         global $user;          $id = !empty($this->params['id']) ? $this->params['id'] : null;          // check to see if we should be editing.  You either need to be an admin, or viewing own account.         if ($user->isAdmin() || ($user->id == $id)) {             $u = new user($id);             if ($u->isSuperAdmin() && $user->isActingAdmin()) {                 flash('error', gt('You do not have the proper permissions to view this record'));                 expHistory::back();             }             parent::show();         } else {             flash('error', gt('You do not have the proper permissions to view this record'));             expHistory::back();         }     }      public function manage() {         global $user; 

Patch:
patch: @@ -62,6 +62,25 @@ static function canImportData() {
         return true;
     }
 
+    public function show() {
+        global $user;
+
+        $id = !empty($this->params['id']) ? $this->params['id'] : null;
+
+        // check to see if we should be editing.  You either need to be an admin, or viewing own account.
+        if ($user->isAdmin() || ($user->id == $id)) {
+            $u = new user($id);
+            if ($u->isSuperAdmin() && $user->isActingAdmin()) {
+                flash('error', gt('You do not have the proper permissions to view this record'));
+                expHistory::back();
+            }
+            parent::show();
+        } else {
+            flash('error', gt('You do not have the proper permissions to view this record'));
+            expHistory::back();
+        }
+    }
+
     public function manage() {
         global $user;
path: framework/modules/users/controllers/usersController.php
Vulnerability: In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.
Vulnerability ID: CVE-2016-9288
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/exponentcms/exponent-cms
Published: 2016-11-11
File: framework/modules/navigation/controllers/navigationController.php
Commit message: fix security vulnerability to reranking pages; reported by kyohpc
Commit author: dleffler

Vulnerable version (before fix):
 class navigationController extends expController {         'move'      => 'Move Page',         'remove'    => 'Remove Page',         'reparent'    => 'Reparent Page',     );     public $remove_configs = array(         'aggregation', public static function returnChildrenAsJSON2() {     public static function DragnDropReRank() {         global $db, $router;          $move   = $router->params['move'];         $target = $router->params['target'];         $type   = $router->params['type'];         $targSec = $db->selectObject("section","id=".$target); //        $targSec  = new section($target);

Fixed version (after fix):
 class navigationController extends expController {         'move'      => 'Move Page',         'remove'    => 'Remove Page',         'reparent'    => 'Reparent Page',         'dragndroprerank'    => 'Rerank Page',         'dragndroprerank2'    => 'Rerank Page',     );     public $remove_configs = array(         'aggregation', public static function returnChildrenAsJSON2() {     public static function DragnDropReRank() {         global $db, $router;          $move   = intval($router->params['move']);         $target = intval($router->params['target']);         $type   = $router->params['type'];         $targSec = $db->selectObject("section","id=".$target); //        $targSec  = new section($target);

Patch:
patch: @@ -39,6 +39,8 @@ class navigationController extends expController {
         'move'      => 'Move Page',
         'remove'    => 'Remove Page',
         'reparent'    => 'Reparent Page',
+        'dragndroprerank'    => 'Rerank Page',
+        'dragndroprerank2'    => 'Rerank Page',
     );
     public $remove_configs = array(
         'aggregation',
@@ -858,8 +860,8 @@ public static function returnChildrenAsJSON2() {
     public static function DragnDropReRank() {
         global $db, $router;
 
-        $move   = $router->params['move'];
-        $target = $router->params['target'];
+        $move   = intval($router->params['move']);
+        $target = intval($router->params['target']);
         $type   = $router->params['type'];
         $targSec = $db->selectObject("section","id=".$target);
 //        $targSec  = new section($target);
path: framework/modules/navigation/controllers/navigationController.php
Vulnerability: Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.
Vulnerability ID: CVE-2016-9387
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/mdadams/jasper
Published: 2017-03-23
File: src/libjasper/jpc/jpc_dec.c
Commit message: Fixed another integer overflow problem.
Commit author: Michael Adams

Vulnerable version (before fix):
 static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms) 	int htileno; 	int vtileno; 	jpc_dec_cmpt_t *cmpt;  	dec->xstart = siz->xoff; 	dec->ystart = siz->yoff; static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms)  	dec->numhtiles = JPC_CEILDIV(dec->xend - dec->tilexoff, dec->tilewidth); 	dec->numvtiles = JPC_CEILDIV(dec->yend - dec->tileyoff, dec->tileheight); 	dec->numtiles = dec->numhtiles * dec->numvtiles; 	JAS_DBGLOG(10, ("numtiles = %d; numhtiles = %d; numvtiles = %d;\n", 	  dec->numtiles, dec->numhtiles, dec->numvtiles)); 	if (!(dec->tiles = jas_alloc2(dec->numtiles, sizeof(jpc_dec_tile_t)))) {

Fixed version (after fix):
 static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms) 	int htileno; 	int vtileno; 	jpc_dec_cmpt_t *cmpt; 	size_t size;  	dec->xstart = siz->xoff; 	dec->ystart = siz->yoff; static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms)  	dec->numhtiles = JPC_CEILDIV(dec->xend - dec->tilexoff, dec->tilewidth); 	dec->numvtiles = JPC_CEILDIV(dec->yend - dec->tileyoff, dec->tileheight); 	if (!jas_safe_size_mul(dec->numhtiles, dec->numvtiles, &size)) { 		return -1; 	} 	dec->numtiles = size; 	JAS_DBGLOG(10, ("numtiles = %d; numhtiles = %d; numvtiles = %d;\n", 	  dec->numtiles, dec->numhtiles, dec->numvtiles)); 	if (!(dec->tiles = jas_alloc2(dec->numtiles, sizeof(jpc_dec_tile_t)))) {

Patch:
patch: @@ -1195,6 +1195,7 @@ static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms)
 	int htileno;
 	int vtileno;
 	jpc_dec_cmpt_t *cmpt;
+	size_t size;
 
 	dec->xstart = siz->xoff;
 	dec->ystart = siz->yoff;
@@ -1231,7 +1232,10 @@ static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms)
 
 	dec->numhtiles = JPC_CEILDIV(dec->xend - dec->tilexoff, dec->tilewidth);
 	dec->numvtiles = JPC_CEILDIV(dec->yend - dec->tileyoff, dec->tileheight);
-	dec->numtiles = dec->numhtiles * dec->numvtiles;
+	if (!jas_safe_size_mul(dec->numhtiles, dec->numvtiles, &size)) {
+		return -1;
+	}
+	dec->numtiles = size;
 	JAS_DBGLOG(10, ("numtiles = %d; numhtiles = %d; numvtiles = %d;\n",
 	  dec->numtiles, dec->numhtiles, dec->numvtiles));
 	if (!(dec->tiles = jas_alloc2(dec->numtiles, sizeof(jpc_dec_tile_t)))) {
path: src/libjasper/jpc/jpc_dec.c
Vulnerability: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause memory corruption in certain conditions via a crafted HTML page.
Vulnerability ID: CVE-2016-9442
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/tats/w3m
Published: 2016-12-12
File: Str.c
Commit message: Merge pull request #27 from kcwu/fix-strgrow

Fix potential heap buffer corruption due to Strgrow
Commit author: Tatsuya Kinoshita

Vulnerable version (before fix):
 Strgrow(Str x) {     char *old = x->ptr;     int newlen;     newlen = x->length * 6 / 5;     if (newlen == x->length) 	newlen += 2;     x->ptr = GC_MALLOC_ATOMIC(newlen);     x->area_size = newlen;

Fixed version (after fix):
 Strgrow(Str x) {     char *old = x->ptr;     int newlen;     newlen = x->area_size * 6 / 5;     if (newlen == x->area_size) 	newlen += 2;     x->ptr = GC_MALLOC_ATOMIC(newlen);     x->area_size = newlen;

Patch:
patch: @@ -232,8 +232,8 @@ Strgrow(Str x)
 {
     char *old = x->ptr;
     int newlen;
-    newlen = x->length * 6 / 5;
-    if (newlen == x->length)
+    newlen = x->area_size * 6 / 5;
+    if (newlen == x->area_size)
 	newlen += 2;
     x->ptr = GC_MALLOC_ATOMIC(newlen);
     x->area_size = newlen;
path: Str.c
Vulnerability: The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.
Vulnerability ID: CVE-2016-9556
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-03-23
File: coders/sgi.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/301
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)     if ((iris_info.bytes_per_pixel == 0) || (iris_info.bytes_per_pixel > 2))       ThrowReaderException(CorruptImageError,"ImproperImageHeader");     iris_info.dimension=ReadBlobMSBShort(image);     iris_info.columns=ReadBlobMSBShort(image);     iris_info.rows=ReadBlobMSBShort(image);     iris_info.depth=ReadBlobMSBShort(image);

Fixed version (after fix):
 static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)     if ((iris_info.bytes_per_pixel == 0) || (iris_info.bytes_per_pixel > 2))       ThrowReaderException(CorruptImageError,"ImproperImageHeader");     iris_info.dimension=ReadBlobMSBShort(image);     if ((iris_info.dimension == 0) || (iris_info.dimension > 3))        ThrowReaderException(CorruptImageError,"ImproperImageHeader");     iris_info.columns=ReadBlobMSBShort(image);     iris_info.rows=ReadBlobMSBShort(image);     iris_info.depth=ReadBlobMSBShort(image);

Patch:
patch: @@ -332,6 +332,8 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if ((iris_info.bytes_per_pixel == 0) || (iris_info.bytes_per_pixel > 2))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     iris_info.dimension=ReadBlobMSBShort(image);
+    if ((iris_info.dimension == 0) || (iris_info.dimension > 3)) 
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     iris_info.columns=ReadBlobMSBShort(image);
     iris_info.rows=ReadBlobMSBShort(image);
     iris_info.depth=ReadBlobMSBShort(image);
path: coders/sgi.c
Vulnerability: Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
Vulnerability ID: CVE-2016-9560
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/mdadams/jasper
Published: 2017-02-15
File: src/libjasper/jpc/jpc_dec.c
Commit message: Fixed an array overflow problem in the JPC decoder.
Commit author: Michael Adams

Vulnerable version (before fix):
 static int jpc_dec_tileinit(jpc_dec_t *dec, jpc_dec_tile_t *tile) 	uint_fast32_t tmpxend; 	uint_fast32_t tmpyend; 	jpc_dec_cp_t *cp; 	jpc_tsfb_band_t bnds[64]; 	jpc_pchg_t *pchg; 	int pchgno; 	jpc_dec_cmpt_t *cmpt;

Fixed version (after fix):
 static int jpc_dec_tileinit(jpc_dec_t *dec, jpc_dec_tile_t *tile) 	uint_fast32_t tmpxend; 	uint_fast32_t tmpyend; 	jpc_dec_cp_t *cp; 	jpc_tsfb_band_t bnds[JPC_MAXBANDS]; 	jpc_pchg_t *pchg; 	int pchgno; 	jpc_dec_cmpt_t *cmpt;

Patch:
patch: @@ -712,7 +712,7 @@ static int jpc_dec_tileinit(jpc_dec_t *dec, jpc_dec_tile_t *tile)
 	uint_fast32_t tmpxend;
 	uint_fast32_t tmpyend;
 	jpc_dec_cp_t *cp;
-	jpc_tsfb_band_t bnds[64];
+	jpc_tsfb_band_t bnds[JPC_MAXBANDS];
 	jpc_pchg_t *pchg;
 	int pchgno;
 	jpc_dec_cmpt_t *cmpt;
path: src/libjasper/jpc/jpc_dec.c
Vulnerability: The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
Vulnerability ID: CVE-2016-9576
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-12-28
File: block/blk-map.c
Commit message: Don't feed anything but regular iovec's to blk_rq_map_user_iov

In theory we could map other things, but there's a reason that function
is called "user_iov".  Using anything else (like splice can do) just
confuses it.

Reported-and-tested-by: Johannes Thumshirn <jthumshirn@suse.de>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Linus Torvalds

Vulnerable version (before fix):
 int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, 	struct iov_iter i; 	int ret;  	if (map_data) 		copy = true; 	else if (iov_iter_alignment(iter) & align) int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,  unmap_rq: 	__blk_rq_unmap_user(bio); 	rq->bio = NULL; 	return -EINVAL; }

Fixed version (after fix):
 int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, 	struct iov_iter i; 	int ret;  	if (!iter_is_iovec(iter)) 		goto fail;  	if (map_data) 		copy = true; 	else if (iov_iter_alignment(iter) & align) int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,  unmap_rq: 	__blk_rq_unmap_user(bio); fail: 	rq->bio = NULL; 	return -EINVAL; }

Patch:
patch: @@ -118,6 +118,9 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
 	struct iov_iter i;
 	int ret;
 
+	if (!iter_is_iovec(iter))
+		goto fail;
+
 	if (map_data)
 		copy = true;
 	else if (iov_iter_alignment(iter) & align)
@@ -140,6 +143,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
 
 unmap_rq:
 	__blk_rq_unmap_user(bio);
+fail:
 	rq->bio = NULL;
 	return -EINVAL;
 }
path: block/blk-map.c
Vulnerability: Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel before 4.5.1 allow local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations.
Vulnerability ID: CVE-2016-9685
CWE: CWE-400
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2016-12-28
File: fs/xfs/xfs_attr_list.c
Commit message: xfs: fix two memory leaks in xfs_attr_list.c error paths

This plugs 2 trivial leaks in xfs_attr_shortform_list and
xfs_attr3_leaf_list_int.

Signed-off-by: Mateusz Guzik <mguzik@redhat.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Commit author: Mateusz Guzik

Vulnerable version (before fix):
 xfs_attr_shortform_list(xfs_attr_list_context_t *context) 					sbp->namelen, 					sbp->valuelen, 					&sbp->name[sbp->namelen]); 		if (error) 			return error; 		if (context->seen_enough) 			break; 		cursor->offset++; xfs_attr3_leaf_list_int( 				args.rmtblkcnt = xfs_attr3_rmt_blocks( 							args.dp->i_mount, valuelen); 				retval = xfs_attr_rmtval_get(&args); 				if (retval) 					return retval; 				retval = context->put_listent(context, 						entry->flags, 						name_rmt->name, 						(int)name_rmt->namelen, 						valuelen, 						args.value); 				kmem_free(args.value); 			} else { 				retval = context->put_listent(context,

Fixed version (after fix):
 xfs_attr_shortform_list(xfs_attr_list_context_t *context) 					sbp->namelen, 					sbp->valuelen, 					&sbp->name[sbp->namelen]); 		if (error) { 			kmem_free(sbuf); 			return error; 		} 		if (context->seen_enough) 			break; 		cursor->offset++; xfs_attr3_leaf_list_int( 				args.rmtblkcnt = xfs_attr3_rmt_blocks( 							args.dp->i_mount, valuelen); 				retval = xfs_attr_rmtval_get(&args); 				if (!retval) 					retval = context->put_listent(context, 							entry->flags, 							name_rmt->name, 							(int)name_rmt->namelen, 							valuelen, 							args.value); 				kmem_free(args.value); 			} else { 				retval = context->put_listent(context,

Patch:
patch: @@ -202,8 +202,10 @@ xfs_attr_shortform_list(xfs_attr_list_context_t *context)
 					sbp->namelen,
 					sbp->valuelen,
 					&sbp->name[sbp->namelen]);
-		if (error)
+		if (error) {
+			kmem_free(sbuf);
 			return error;
+		}
 		if (context->seen_enough)
 			break;
 		cursor->offset++;
@@ -454,14 +456,13 @@ xfs_attr3_leaf_list_int(
 				args.rmtblkcnt = xfs_attr3_rmt_blocks(
 							args.dp->i_mount, valuelen);
 				retval = xfs_attr_rmtval_get(&args);
-				if (retval)
-					return retval;
-				retval = context->put_listent(context,
-						entry->flags,
-						name_rmt->name,
-						(int)name_rmt->namelen,
-						valuelen,
-						args.value);
+				if (!retval)
+					retval = context->put_listent(context,
+							entry->flags,
+							name_rmt->name,
+							(int)name_rmt->namelen,
+							valuelen,
+							args.value);
 				kmem_free(args.value);
 			} else {
 				retval = context->put_listent(context,
path: fs/xfs/xfs_attr_list.c
Vulnerability: The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option.
Vulnerability ID: CVE-2016-9793
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-12-28
File: net/core/sock.c
Commit message: net: avoid signed overflows for SO_{SND|RCV}BUFFORCE

CAP_NET_ADMIN users should not be allowed to set negative
sk_sndbuf or sk_rcvbuf values, as it can lead to various memory
corruptions, crashes, OOM...

Note that before commit 82981930125a ("net: cleanups in
sock_setsockopt()"), the bug was even more serious, since SO_SNDBUF
and SO_RCVBUF were vulnerable.

This needs to be backported to all known linux kernels.

Again, many thanks to syzkaller team for discovering this gem.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Eric Dumazet

Vulnerable version (before fix):
 int sock_setsockopt(struct socket *sock, int level, int optname, 		val = min_t(u32, val, sysctl_wmem_max); set_sndbuf: 		sk->sk_userlocks |= SOCK_SNDBUF_LOCK; 		sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF); 		/* Wake up sending tasks if we upped the value. */ 		sk->sk_write_space(sk); 		break; int sock_setsockopt(struct socket *sock, int level, int optname, 		 * returning the value we actually used in getsockopt 		 * is the most desirable behavior. 		 */ 		sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF); 		break;  	case SO_RCVBUFFORCE:

Fixed version (after fix):
 int sock_setsockopt(struct socket *sock, int level, int optname, 		val = min_t(u32, val, sysctl_wmem_max); set_sndbuf: 		sk->sk_userlocks |= SOCK_SNDBUF_LOCK; 		sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF); 		/* Wake up sending tasks if we upped the value. */ 		sk->sk_write_space(sk); 		break; int sock_setsockopt(struct socket *sock, int level, int optname, 		 * returning the value we actually used in getsockopt 		 * is the most desirable behavior. 		 */ 		sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF); 		break;  	case SO_RCVBUFFORCE:

Patch:
patch: @@ -715,7 +715,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 		val = min_t(u32, val, sysctl_wmem_max);
 set_sndbuf:
 		sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
-		sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF);
+		sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
 		/* Wake up sending tasks if we upped the value. */
 		sk->sk_write_space(sk);
 		break;
@@ -751,7 +751,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 		 * returning the value we actually used in getsockopt
 		 * is the most desirable behavior.
 		 */
-		sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF);
+		sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
 		break;
 
 	case SO_RCVBUFFORCE:
path: net/core/sock.c