From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E30FC04E53 for ; Wed, 15 May 2019 11:37:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1671420578 for ; Wed, 15 May 2019 11:37:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557920250; bh=xSihnVmtY+9iC4up/Mcox0MkU/6kFtZPpELlpQf8rew=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=cPQJUqOozbxN8rawDrzAfZEnnSDwTy1LVJaniQzYw81E0E0T1jlLRJ9sJ2rqrKqxf NcchDmMGhjz7Rr8QidCDeqqYsbWM3za/MbKXG/sdJo7dmpsfqb8tTuEZ8J9jLPfZi6 8uok4X1in/RLEpCtYjRY9x8nanhUUb0nbjQRC6iQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732991AbfEOLh3 (ORCPT ); Wed, 15 May 2019 07:37:29 -0400 Received: from mail.kernel.org ([198.145.29.99]:43776 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732950AbfEOLb6 (ORCPT ); Wed, 15 May 2019 07:31:58 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CD8842084F; Wed, 15 May 2019 11:31:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557919918; bh=xSihnVmtY+9iC4up/Mcox0MkU/6kFtZPpELlpQf8rew=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uk5btYLOy2kj30AvIg5Zr0d9R0bkKCDGC0uZR6lPp5Jme5v+PPEKDEhC3VsOmnEkP m+yZsTiQUCDzWj/q9+dq0XeOpd1rufyErLyoPlVVIKacwcRg+m5kzQjtthgH4iFrKC CuWFIEhs10atmdqI/RuahorjypR67RxsX3Sw+7l4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Andrew Morton , Timur Tabi , Mihai Caraman , Kumar Gala , Linus Torvalds Subject: [PATCH 5.0 129/137] drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl Date: Wed, 15 May 2019 12:56:50 +0200 Message-Id: <20190515090703.253516189@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190515090651.633556783@linuxfoundation.org> References: <20190515090651.633556783@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dan Carpenter commit 6a024330650e24556b8a18cc654ad00cfecf6c6c upstream. The "param.count" value is a u64 thatcomes from the user. The code later in the function assumes that param.count is at least one and if it's not then it leads to an Oops when we dereference the ZERO_SIZE_PTR. Also the addition can have an integer overflow which would lead us to allocate a smaller "pages" array than required. I can't immediately tell what the possible run times implications are, but it's safest to prevent the overflow. Link: http://lkml.kernel.org/r/20181218082129.GE32567@kadam Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver") Signed-off-by: Dan Carpenter Reviewed-by: Andrew Morton Cc: Timur Tabi Cc: Mihai Caraman Cc: Kumar Gala Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- drivers/virt/fsl_hypervisor.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/virt/fsl_hypervisor.c +++ b/drivers/virt/fsl_hypervisor.c @@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_i * hypervisor. */ lb_offset = param.local_vaddr & (PAGE_SIZE - 1); + if (param.count == 0 || + param.count > U64_MAX - lb_offset - PAGE_SIZE + 1) + return -EINVAL; num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT; /* Allocate the buffers we need */