From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
Peter Malone <peter.malone@gmail.com>,
Philippe Ombredanne <pombredanne@nexb.com>,
Mathieu Malaterre <malat@debian.org>,
Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>,
Sasha Levin <sashal@kernel.org>,
dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.4 33/48] fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper()
Date: Tue, 12 Nov 2019 21:01:16 -0500 [thread overview]
Message-ID: <20191113020131.13356-33-sashal@kernel.org> (raw)
In-Reply-To: <20191113020131.13356-1-sashal@kernel.org>
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit e5017716adb8aa5c01c52386c1b7470101ffe9c5 ]
The "index + count" addition can overflow. Both come directly from the
user. This bug leads to an information leak.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Peter Malone <peter.malone@gmail.com>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Cc: Mathieu Malaterre <malat@debian.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/sbuslib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c
index b425718925c01..52e161dbd2047 100644
--- a/drivers/video/fbdev/sbuslib.c
+++ b/drivers/video/fbdev/sbuslib.c
@@ -170,7 +170,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
get_user(ublue, &c->blue))
return -EFAULT;
- if (index + count > cmap->len)
+ if (index > cmap->len || count > cmap->len - index)
return -EINVAL;
for (i = 0; i < count; i++) {
--
2.20.1
next prev parent reply other threads:[~2019-11-13 2:02 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-13 2:00 [PATCH AUTOSEL 4.4 01/48] net: ovs: fix return type of ndo_start_xmit function Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 02/48] ARM: dts: omap5: enable OTG role for DWC3 controller Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 03/48] f2fs: return correct errno in f2fs_gc Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 04/48] SUNRPC: Fix priority queue fairness Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 05/48] ath10k: fix vdev-start timeout on error Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 06/48] ath9k: fix reporting calculated new FFT upper max Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 07/48] usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in fotg210_get_status() Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 08/48] nl80211: Fix a GET_KEY reply attribute Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 09/48] dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 10/48] dmaengine: timb_dma: Use proper enum in td_prep_slave_sg Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 11/48] mei: samples: fix a signedness bug in amt_host_if_call() Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 12/48] cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 13/48] cxgb4: Use proper enum in IEEE_FAUX_SYNC Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 14/48] powerpc/pseries: Fix DTL buffer registration Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 15/48] powerpc/pseries: Fix how we iterate over the DTL entries Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 16/48] mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 17/48] ixgbe: Fix crash with VFs and flow director on interface flap Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 18/48] IB/mthca: Fix error return code in __mthca_init_one() Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 19/48] ata: ep93xx: Use proper enums for directions Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 20/48] ALSA: hda/sigmatel - Disable automute for Elo VuPoint Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 21/48] KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup both PC and LR Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 22/48] USB: serial: cypress_m8: fix interrupt-out transfer length Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 23/48] mtd: physmap_of: Release resources on error Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 24/48] brcmfmac: fix full timeout waiting for action frame on-channel tx Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 25/48] NFSv4.x: fix lock recovery during delegation recall Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 26/48] dmaengine: ioat: fix prototype of ioat_enumerate_channels Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 27/48] Input: st1232 - set INPUT_PROP_DIRECT property Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 28/48] x86/olpc: Fix build error with CONFIG_MFD_CS5535=m Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 29/48] crypto: mxs-dcp - Fix SHA null hashes and output length Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 30/48] crypto: mxs-dcp - Fix AES issues Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 31/48] ACPI / SBS: Fix rare oops when removing modules Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 32/48] fbdev: sbuslib: use checked version of put_user() Sasha Levin
2019-11-13 2:01 ` Sasha Levin [this message]
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 34/48] bcache: recal cached_dev_sectors on detach Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 35/48] proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted() Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 36/48] backlight: lm3639: Unconditionally call led_classdev_unregister Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 37/48] printk: Give error on attempt to set log buffer length to over 2G Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 38/48] media: isif: fix a NULL pointer dereference bug Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 39/48] GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 40/48] media: cx231xx: fix potential sign-extension overflow on large shift Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 41/48] x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 42/48] gpio: syscon: Fix possible NULL ptr usage Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 43/48] spi: spidev: Fix OF tree warning logic Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 44/48] ARM: 8802/1: Call syscall_trace_exit even when system call skipped Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 45/48] hwmon: (pwm-fan) Silence error on probe deferral Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 46/48] mac80211: minstrel: fix CCK rate group streams value Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 47/48] spi: rockchip: initialize dma_slave_config properly Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 48/48] ARM: dts: omap5: Fix dual-role mode on Super-Speed port Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191113020131.13356-33-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=b.zolnierkie@samsung.com \
--cc=dan.carpenter@oracle.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-fbdev@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=malat@debian.org \
--cc=peter.malone@gmail.com \
--cc=pombredanne@nexb.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox