From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1322BC32772 for ; Mon, 22 Aug 2022 10:01:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233406AbiHVKBc (ORCPT ); Mon, 22 Aug 2022 06:01:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234372AbiHVKB2 (ORCPT ); Mon, 22 Aug 2022 06:01:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 61B0731EEB for ; Mon, 22 Aug 2022 03:01:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DFD5760F8D for ; Mon, 22 Aug 2022 10:01:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E60EEC433C1; Mon, 22 Aug 2022 10:01:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661162485; bh=bO/ALU+BgGGJCirLHmzFrC3tMjo6CNH75F00tpAQeG4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=Qj6fx4MRQ2YyOvSg1UYoCuKwNTZxrZe7SQPa0Wtv+fGF9XlThijQ3qy0RBB6XU1KF EdVQQL9Zz15Roe2n54PZsXsRXB8lx/Qphmcf6G7WyoLRaUvcx9tnXow/3nAOMwoxgy LvOeuQy059/yWkyKXipVxWV5OrNx/uaq8RGuHv7M= Date: Mon, 22 Aug 2022 12:01:22 +0200 From: Greg KH To: Jens Wiklander Cc: stable@vger.kernel.org, Sumit Garg , Jerome Forissier , Nimish Mishra , Anirban Chakraborty , Debdeep Mukhopadhyay , Linus Torvalds Subject: Re: [PATCH] tee: add overflow check in tee_ioctl_shm_register() Message-ID: References: <20220822092621.3691771-1-jens.wiklander@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On Mon, Aug 22, 2022 at 11:59:17AM +0200, Greg KH wrote: > On Mon, Aug 22, 2022 at 11:26:21AM +0200, Jens Wiklander wrote: > > commit 573ae4f13f630d6660008f1974c0a8a29c30e18a upstream. > > > > With special lengths supplied by user space, tee_shm_register() has > > an integer overflow when calculating the number of pages covered by a > > supplied user space memory region. > > > > This may cause pin_user_pages_fast() to do a NULL pointer dereference. > > > > Fix this by adding an an explicit call to access_ok() in > > tee_ioctl_shm_register() to catch an invalid user space address early. > > > > Fixes: 033ddf12bcf5 ("tee: add register user memory") > > Cc: stable@vger.kernel.org # 5.4 > > Reported-by: Nimish Mishra > > Reported-by: Anirban Chakraborty > > Reported-by: Debdeep Mukhopadhyay > > Suggested-by: Jerome Forissier > > Signed-off-by: Linus Torvalds > > [JW: backport to stable-5.4 + update commit message] > > Will this also work for 4.19? Nope, it breaks the build on 4.19.y, needs a different backport there: CC [M] drivers/tee/tee_core.o drivers/tee/tee_core.c: In function ‘tee_ioctl_shm_register’: drivers/tee/tee_core.c:178:76: error: macro "access_ok" requires 3 arguments, but only 2 given 178 | if (!access_ok((void __user *)(unsigned long)data.addr, data.length)) | ^ In file included from ./include/linux/uaccess.h:14, from drivers/tee/tee_core.c:24: ./arch/x86/include/asm/uaccess.h:98: note: macro "access_ok" defined here 98 | #define access_ok(type, addr, size) \ | drivers/tee/tee_core.c:178:14: error: ‘access_ok’ undeclared (first use in this function) 178 | if (!access_ok((void __user *)(unsigned long)data.addr, data.length)) | ^~~~~~~~~